Most Exploitable CVEs - EPSS Rankings
CVEs ranked by EPSS (Exploit Prediction Scoring System) probability. Higher scores mean a greater likelihood of exploitation in the wild within the next 30 days.
164
EPSS > 50%
156
CISA KEV Listed
35,468
CVEs with EPSS
0.7%
Avg EPSS Score
| Rank | CVE ID | EPSS Score | Percentile | CVSS | Flags | Summary |
|---|---|---|---|---|---|---|
| 2701 | CVE-2025-5996 |
|
30.3th | 6.5 | This vulnerability in GitLab CE/EE allows authenticated users to cause denial of service through imp | |
| 2702 | CVE-2025-5544 |
|
30.4th | 4.3 | This CVE describes a path traversal vulnerability in the aaluoxiang oa_system that allows attackers | |
| 2703 | CVE-2025-23486 |
|
30.1th | 6.5 | This CVE describes a Missing Authorization vulnerability in the NotFound Database Sync WordPress plu | |
| 2704 | CVE-2025-1642 |
|
30.2th | 4.3 | This vulnerability in Benner ModernaNet allows attackers to manipulate resource identifiers via the | |
| 2705 | CVE-2024-9601 |
|
30.3th | 6.5 | The Qubely WordPress plugin has a stored XSS vulnerability that allows authenticated attackers with | |
| 2706 | CVE-2025-23763 |
|
30.1th | 6.5 | This CVE describes a Missing Authorization vulnerability in the WAH Forms WordPress plugin that allo | |
| 2707 | CVE-2025-6720 |
|
30.2th | 5.3 | The Vchasno Kasa WordPress plugin has an unauthenticated data deletion vulnerability that allows att | |
| 2708 | CVE-2025-5811 |
|
30.2th | 5.3 | The Listly WordPress plugin has an authentication bypass vulnerability that allows unauthenticated a | |
| 2709 | CVE-2025-11100 |
|
30.2th | 6.3 | This vulnerability allows remote attackers to execute arbitrary commands on D-Link DIR-823X routers | |
| 2710 | CVE-2025-11099 |
|
30.2th | 6.3 | This vulnerability allows remote attackers to execute arbitrary commands on D-Link DIR-823X routers | |
| 2711 | CVE-2025-11098 |
|
30.2th | 6.3 | This CVE describes a command injection vulnerability in D-Link DIR-823X routers that allows remote a | |
| 2712 | CVE-2025-11097 |
|
30.2th | 6.3 | This vulnerability allows remote attackers to execute arbitrary commands on D-Link DIR-823X routers | |
| 2713 | CVE-2025-11096 |
|
30.2th | 6.3 | This CVE describes a command injection vulnerability in D-Link DIR-823X routers that allows remote a | |
| 2714 | CVE-2025-35435 |
|
30.2th | 4.3 | CVE-2025-35435 is a division-by-zero vulnerability in CISA Thorium that allows authenticated remote | |
| 2715 | CVE-2025-60023 |
|
30.2th | 4.0 | A relative path traversal vulnerability in Productivity Suite software version 4.4.1.19 allows unaut | |
| 2716 | CVE-2025-60830 |
|
30.2th | 6.5 | Redragon ERP v1.0 contains a Shiro deserialization vulnerability due to the use of default Shiro cry | |
| 2717 | CVE-2025-60828 |
|
30.2th | 6.5 | WukongCRM 9.0-JAVA contains a fastjson deserialization vulnerability in the /OaExamine/setOaExamine | |
| 2718 | CVE-2025-42894 |
|
30.2th | 6.8 | This CVE describes a Path Traversal vulnerability in SAP Business Connector that allows authenticate | |
| 2719 | CVE-2025-7663 |
|
30.2th | 6.5 | The Ovatheme Events Manager WordPress plugin has a missing capability check vulnerability that allow | |
| 2720 | CVE-2025-43464 |
|
30.2th | 6.5 | This CVE describes a denial-of-service vulnerability in macOS where visiting a malicious website cou | |
| 2721 | CVE-2025-13875 |
|
30.2th | 6.3 | This vulnerability allows remote attackers to perform path traversal attacks in Yohann0617 oci-helpe | |
| 2722 | CVE-2024-31088 |
|
30.1th | 6.5 | This DOM-based XSS vulnerability in the AdsPlace'r WordPress plugin allows attackers to inject malic | |
| 2723 | CVE-2025-21568 |
|
30.1th | 4.5 | This vulnerability in Oracle Hyperion Data Relationship Management allows high-privileged attackers | |
| 2724 | CVE-2025-23080 |
|
30.1th | 5.3 | This CVE describes a cross-site scripting (XSS) vulnerability in the MediaWiki OpenBadges extension. | |
| 2725 | CVE-2025-23078 |
|
30.1th | 6.5 | This CVE describes a Cross-Site Scripting (XSS) vulnerability in the Mediawiki Breadcrumbs2 extensio | |
| 2726 | CVE-2025-23225 |
|
30th | 6.5 | This vulnerability in IBM MQ allows authenticated users to send specially crafted messages with inva | |
| 2727 | CVE-2025-1488 |
|
30th | 4.7 | The WPO365 Microsoft 365 Graph Mailer WordPress plugin has an open redirect vulnerability in all ver | |
| 2728 | CVE-2024-13369 |
|
30.1th | 6.5 | This vulnerability allows authenticated attackers with Subscriber-level access or higher to perform | |
| 2729 | CVE-2024-13601 |
|
30.1th | 4.3 | This vulnerability allows authenticated WordPress users with Subscriber-level access or higher to ex | |
| 2730 | CVE-2024-55212 |
|
30th | 6.5 | DNNGo xBlog v6.5.0 contains a SQL injection vulnerability in the Categorys parameter at /DNNGo_xBlog | |
| 2731 | CVE-2025-29778 |
|
30.1th | 5.8 | Kyverno versions before 1.14.0-alpha.1 ignore subjectRegExp and issuerRegExp validations when verify | |
| 2732 | CVE-2025-1408 |
|
30.1th | 4.3 | This vulnerability allows authenticated WordPress users with Subscriber-level access or higher to ap | |
| 2733 | CVE-2024-12114 |
|
30.1th | 4.3 | This vulnerability in the FooGallery WordPress plugin allows authenticated attackers with gallery cr | |
| 2734 | CVE-2023-35817 |
|
30th | 5.0 | This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in DevExpress AsyncDownloader | |
| 2735 | CVE-2025-22081 |
|
30th | 5.5 | This CVE describes an integer overflow vulnerability in the NTFS3 filesystem driver in the Linux ker | |
| 2736 | CVE-2025-22062 |
|
30th | 5.5 | A race condition vulnerability in the Linux kernel's SCTP protocol implementation allows concurrent | |
| 2737 | CVE-2025-31721 |
|
30th | 4.3 | This vulnerability allows attackers with Computer/Create permission in Jenkins to copy agent configu | |
| 2738 | CVE-2025-30476 |
|
30th | 5.3 | Dell PowerScale InsightIQ version 5.2 has an uncontrolled resource consumption vulnerability that al | |
| 2739 | CVE-2025-30314 |
|
30.1th | 6.1 | Adobe Connect versions 12.8 and earlier contain a stored Cross-Site Scripting vulnerability where at | |
| 2740 | CVE-2022-50802 |
|
30.1th | 6.1 | ETAP Safety Manager 1.0.0.32 contains an unauthenticated reflected cross-site scripting vulnerabilit | |
| 2741 | CVE-2025-14692 |
|
30th | 4.3 | This CVE describes an open redirect vulnerability in Mayan EDMS up to version 4.10.1. Attackers can | |
| 2742 | CVE-2025-64993 |
|
30.1th | 6.8 | A command injection vulnerability in TeamViewer DEX (formerly 1E DEX) allows authenticated attackers | |
| 2743 | CVE-2025-64992 |
|
30.1th | 6.8 | A command injection vulnerability in TeamViewer DEX (formerly 1E DEX) allows authenticated attackers | |
| 2744 | CVE-2025-64991 |
|
30.1th | 6.8 | A command injection vulnerability in TeamViewer DEX (formerly 1E DEX) allows authenticated attackers | |
| 2745 | CVE-2025-14063 |
|
30th | 6.1 | The SEO Links Interlinking WordPress plugin contains a reflected cross-site scripting (XSS) vulnerab | |
| 2746 | CVE-2025-0783 |
|
29.8th | 6.3 | This vulnerability allows unauthorized access to API endpoints in pankajindevops scale up software d | |
| 2747 | CVE-2024-55930 |
|
29.9th | 6.7 | Xerox Workplace Suite has insecure default folder permissions that allow unauthorized users to acces | |
| 2748 | CVE-2024-53649 |
|
29.9th | 6.5 | This vulnerability in Siemens SIPROTEC 5 protection devices allows authenticated remote attackers to | |
| 2749 | CVE-2025-27141 |
|
29.9th | 6.5 | In Metabase Enterprise Edition, users with impersonation permissions can access cached query results | |
| 2750 | CVE-2024-12012 |
|
29.8th | 5.7 | This vulnerability exposes password hashes and session tokens in URLs due to improper use of GET req |
What is EPSS?
The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation — making it ideal for prioritizing which vulnerabilities to patch first.
Why EPSS matters: With thousands of CVEs published monthly, not all vulnerabilities are equally dangerous. EPSS helps security teams focus on the CVEs most likely to be actively exploited, rather than patching solely by CVSS score. A critical CVSS 9.8 vulnerability with 0.1% EPSS may be less urgent than a high CVSS 7.5 with 90% EPSS.
Prioritize by Exploit Risk
Scan your servers and see which vulnerabilities have the highest EPSS scores. Focus on what attackers are actually targeting.
Start Monitoring Free