Most Exploitable CVEs - EPSS Rankings
CVEs ranked by EPSS (Exploit Prediction Scoring System) probability. Higher scores mean a greater likelihood of exploitation in the wild within the next 30 days.
164
EPSS > 50%
156
CISA KEV Listed
35,468
CVEs with EPSS
0.7%
Avg EPSS Score
| Rank | CVE ID | EPSS Score | Percentile | CVSS | Flags | Summary |
|---|---|---|---|---|---|---|
| 251 | CVE-2025-22462 |
|
89.8th | 9.8 | An authentication bypass vulnerability in Ivanti Neurons for ITSM on-premises deployments allows rem | |
| 252 | CVE-2024-13742 |
|
89.6th | 9.8 | The iControlWP WordPress plugin is vulnerable to PHP object injection via deserialization of untrust | |
| 253 | CVE-2025-23025 |
|
89.5th | 9.0 | In XWiki Platform, users with only edit rights can join realtime editing sessions and insert script | |
| 254 | CVE-2025-29062 |
|
89.4th | 9.8 | This vulnerability allows remote attackers to execute arbitrary code on BL-AC2100 routers by exploit | |
| 255 | CVE-2024-53842 |
|
89.4th | 9.8 | This critical vulnerability allows remote attackers to execute arbitrary code on affected Android de | |
| 256 | CVE-2025-20393 |
|
89.4th | 10.0 | KEV | An unauthenticated remote attacker can execute arbitrary system commands with root privileges on Cis |
| 257 | CVE-2025-59403 |
|
89.3th | 9.8 | The Flock Safety Collins Android app exposes unauthenticated administrative API endpoints on port 80 | |
| 258 | CVE-2025-1550 |
|
89.2th | 9.8 | CVE-2025-1550 is a critical remote code execution vulnerability in Keras where the Model.load_model | |
| 259 | CVE-2024-48841 |
|
89.2th | 10.0 | This critical vulnerability in FLXEON software allows remote attackers to execute arbitrary code wit | |
| 260 | CVE-2025-0851 |
|
89.1th | 9.8 | A path traversal vulnerability in Deep Java Library's ZipUtils.unzip and TarUtils.untar functions al | |
| 261 | CVE-2025-22949 |
|
89.1th | 9.8 | This vulnerability allows remote attackers to execute arbitrary commands on Tenda AC9 routers by inj | |
| 262 | CVE-2025-27780 |
|
89th | 9.8 | This vulnerability allows remote attackers to execute arbitrary code on Applio voice conversion tool | |
| 263 | CVE-2024-8673 |
|
88.8th | 9.1 | The Z-Downloads WordPress plugin before version 1.11.7 fails to properly validate uploaded SVG files | |
| 264 | CVE-2025-3439 |
|
88.8th | 9.8 | The Everest Forms WordPress plugin is vulnerable to PHP object injection via deserialization of untr | |
| 265 | CVE-2024-48760 |
|
88.7th | 9.8 | CVE-2024-48760 is a critical remote code execution vulnerability in GestioIP v3.5.7 that allows atta | |
| 266 | CVE-2025-6802 |
|
88.7th | 9.8 | This vulnerability allows unauthenticated remote attackers to upload arbitrary files to Marvell QCon | |
| 267 | CVE-2024-13545 |
|
88.6th | 9.8 | The Bootstrap Ultimate WordPress theme contains a Local File Inclusion vulnerability that allows una | |
| 268 | CVE-2024-57583 |
|
88.6th | 9.8 | This CVE describes a command injection vulnerability in Tenda AC18 routers that allows attackers to | |
| 269 | CVE-2025-1716 |
|
88.5th | 9.8 | CVE-2025-1716 is a critical vulnerability in picklescan versions before 0.0.21 where the tool fails | |
| 270 | CVE-2025-29972 |
|
88.5th | 9.9 | This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Azure services that allows | |
| 271 | CVE-2025-28256 |
|
88.4th | 9.8 | This vulnerability allows remote attackers to execute arbitrary code on TOTOLINK A3100R routers by e | |
| 272 | CVE-2025-61045 |
|
88.4th | 9.8 | This vulnerability allows remote attackers to execute arbitrary commands on TOTOLINK X18 routers by | |
| 273 | CVE-2025-22912 |
|
88.2th | 9.8 | CVE-2025-22912 is a command injection vulnerability in RE11S v1.11 that allows attackers to execute | |
| 274 | CVE-2025-22906 |
|
88.2th | 9.8 | CVE-2025-22906 is a critical command injection vulnerability in RE11S v1.11 that allows attackers to | |
| 275 | CVE-2025-31477 |
|
88.1th | 9.8 | CVE-2025-31477 is a critical vulnerability in Tauri's shell plugin that allows remote code execution | |
| 276 | CVE-2025-49212 |
|
88.1th | 9.8 | This vulnerability allows unauthenticated remote attackers to execute arbitrary code on Trend Micro | |
| 277 | CVE-2025-45042 |
|
88th | 9.8 | This vulnerability allows remote attackers to execute arbitrary commands on Tenda AC9 routers via th | |
| 278 | CVE-2025-20055 |
|
87.9th | 9.8 | This CVE describes an OS command injection vulnerability in Y'S corporation STEALTHONE D220/D340 net | |
| 279 | CVE-2024-13365 |
|
87.7th | 9.8 | The CleanTalk Security & Malware plugin for WordPress has a critical vulnerability allowing unauthen | |
| 280 | CVE-2024-10553 |
|
87.7th | 9.8 | This vulnerability allows unauthenticated remote attackers to execute arbitrary code on H2O-3 machin | |
| 281 | CVE-2025-0912 |
|
87.6th | 9.8 | The Donations Widget WordPress plugin contains a PHP object injection vulnerability that allows unau | |
| 282 | CVE-2025-43849 |
|
87.6th | 9.8 | This vulnerability allows remote attackers to execute arbitrary code on systems running Retrieval-ba | |
| 283 | CVE-2025-27782 |
|
87.6th | 9.8 | Applio voice conversion tool versions 3.2.8-bugfix and prior contain an arbitrary file write vulnera | |
| 284 | CVE-2025-8324 |
|
87.6th | 9.8 | CVE-2025-8324 is an unauthenticated SQL injection vulnerability in Zohocorp ManageEngine Analytics P | |
| 285 | CVE-2025-59304 |
|
87.5th | 9.8 | A directory traversal vulnerability in Swetrix Web Analytics API allows attackers to bypass path res | |
| 286 | CVE-2023-51951 |
|
87.3th | 9.8 | This SQL injection vulnerability in Stock Management System 1.0 allows remote attackers to execute a | |
| 287 | CVE-2025-43851 |
|
87.3th | 9.8 | This vulnerability allows remote code execution through unsafe deserialization in Retrieval-based-Vo | |
| 288 | CVE-2025-43848 |
|
87.3th | 9.8 | CVE-2025-43848 is an unsafe deserialization vulnerability in Retrieval-based-Voice-Conversion-WebUI | |
| 289 | CVE-2025-43846 |
|
87.3th | 9.8 | CVE-2025-43846 is a critical unsafe deserialization vulnerability in Retrieval-based-Voice-Conversio | |
| 290 | CVE-2025-34221 |
|
87.2th | 9.8 | This vulnerability allows unauthenticated attackers to access all internal Docker containers in Vasi | |
| 291 | CVE-2026-24858 |
|
87.2th | 9.8 | KEV | This authentication bypass vulnerability allows attackers with a FortiCloud account and registered d |
| 292 | CVE-2024-13789 |
|
87.1th | 9.8 | The ravpage WordPress plugin is vulnerable to PHP object injection via deserialization of untrusted | |
| 293 | CVE-2024-12562 |
|
87.1th | 9.8 | The s2Member Pro WordPress plugin is vulnerable to PHP object injection via deserialization of untru | |
| 294 | CVE-2025-27778 |
|
87th | 9.8 | Applio versions 3.2.8-bugfix and prior contain an unsafe deserialization vulnerability in infer.py t | |
| 295 | CVE-2025-44880 |
|
87th | 9.8 | This CVE describes a critical command injection vulnerability in Wavlink WL-WN579A3 routers that all | |
| 296 | CVE-2025-44881 |
|
87th | 9.8 | This CVE describes a critical command injection vulnerability in the Wavlink WL-WN579A3 router's QoS | |
| 297 | CVE-2025-28034 |
|
86.9th | 9.8 | This CVE describes a pre-authentication remote command execution vulnerability in multiple TOTOLINK | |
| 298 | CVE-2025-11005 |
|
86.7th | 9.8 | This CVE describes an OS command injection vulnerability in TOTOLINK X6000R routers that allows atta | |
| 299 | CVE-2024-13448 |
|
86.7th | 9.8 | The ThemeREX Addons WordPress plugin allows unauthenticated attackers to upload arbitrary files due | |
| 300 | CVE-2024-54676 |
|
86.7th | 9.8 | Apache OpenMeetings versions 2.1.0 through 7.x have insecure default clustering configurations that |
What is EPSS?
The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation — making it ideal for prioritizing which vulnerabilities to patch first.
Why EPSS matters: With thousands of CVEs published monthly, not all vulnerabilities are equally dangerous. EPSS helps security teams focus on the CVEs most likely to be actively exploited, rather than patching solely by CVSS score. A critical CVSS 9.8 vulnerability with 0.1% EPSS may be less urgent than a high CVSS 7.5 with 90% EPSS.
Prioritize by Exploit Risk
Scan your servers and see which vulnerabilities have the highest EPSS scores. Focus on what attackers are actually targeting.
Start Monitoring Free