Most Exploitable CVEs - EPSS Rankings
CVEs ranked by EPSS (Exploit Prediction Scoring System) probability. Higher scores mean a greater likelihood of exploitation in the wild within the next 30 days.
164
EPSS > 50%
156
CISA KEV Listed
35,468
CVEs with EPSS
0.7%
Avg EPSS Score
| Rank | CVE ID | EPSS Score | Percentile | CVSS | Flags | Summary |
|---|---|---|---|---|---|---|
| 2951 | CVE-2025-49887 |
|
17.1th | 9.9 | This vulnerability allows remote attackers to execute arbitrary code on WordPress sites running the | |
| 2952 | CVE-2025-27261 |
|
17.2th | 9.8 | Ericsson Indoor Connect 8855 contains an SQL injection vulnerability that allows attackers to execut | |
| 2953 | CVE-2025-11717 |
|
17.2th | 9.1 | This vulnerability in Firefox for Android allows attackers to view password-related screens when swi | |
| 2954 | CVE-2025-61605 |
|
17.2th | 9.8 | WeGIA versions 3.4.12 and below contain an SQL injection vulnerability in the /pet/profile_pet.php e | |
| 2955 | CVE-2025-61603 |
|
17.2th | 9.8 | CVE-2025-61603 is a critical SQL injection vulnerability in WeGIA web management software for charit | |
| 2956 | CVE-2025-49752 |
|
17.1th | 10.0 | CVE-2025-49752 is an elevation of privilege vulnerability in Azure Bastion that allows authenticated | |
| 2957 | CVE-2025-68562 |
|
17th | 9.9 | This vulnerability allows attackers to upload arbitrary files, including web shells, to servers runn | |
| 2958 | CVE-2025-64374 |
|
17th | 9.9 | This vulnerability allows attackers to upload malicious files to WordPress sites using the Motors th | |
| 2959 | CVE-2025-43526 |
|
16.9th | 9.8 | A URL validation vulnerability in macOS and Safari allows web content opened via file URLs to bypass | |
| 2960 | CVE-2026-24793 |
|
17.2th | 9.8 | This CVE describes a classic buffer overflow vulnerability in AzerothCore's Wrath of the Lich King i | |
| 2961 | CVE-2025-63314 |
|
17th | 10.0 | CVE-2025-63314 is a critical authentication bypass vulnerability in DDSN Interactive Acora CMS v10.7 | |
| 2962 | CVE-2025-40666 |
|
16.9th | 9.8 | CVE-2025-40666 is a critical SQL injection vulnerability in TCMAN's GIM v11 that allows attackers to | |
| 2963 | CVE-2025-52362 |
|
16.7th | 9.1 | This SSRF vulnerability in PHProxy allows attackers to bypass URL validation and make unauthorized r | |
| 2964 | CVE-2025-50341 |
|
16.9th | 9.8 | A Boolean-based SQL injection vulnerability in Axelor 5.2.4 allows attackers to manipulate SQL queri | |
| 2965 | CVE-2025-44954 |
|
16.6th | 9.0 | RUCKUS SmartZone network controllers before version 6.1.2p3 Refresh Build contain a hardcoded SSH pr | |
| 2966 | CVE-2025-34196 |
|
16.7th | 9.8 | Vasion Print (formerly PrinterLogic) contains hardcoded private keys and passwords in configuration | |
| 2967 | CVE-2025-11624 |
|
16.9th | 9.8 | This CVE describes a stack buffer overflow vulnerability in wolfSSH's SFTP server when processing ma | |
| 2968 | CVE-2025-11892 |
|
16.7th | 9.6 | This DOM-based XSS vulnerability in GitHub Enterprise Server allows attackers to execute malicious s | |
| 2969 | CVE-2025-1928 |
|
16.9th | 9.1 | This vulnerability allows attackers to bypass password recovery rate limiting in Restajet's Online F | |
| 2970 | CVE-2026-25803 |
|
16.9th | 9.8 | 3DP-MANAGER versions 2.0.1 and earlier automatically create an administrative account with default c | |
| 2971 | CVE-2026-24371 |
|
16.9th | 9.8 | This CVE describes a Missing Authorization vulnerability in the BA Book Everything WordPress plugin | |
| 2972 | CVE-2026-25763 |
|
16.7th | 9.9 | OpenProject versions before 16.6.7 and 17.0.3 contain an arbitrary file write vulnerability that can | |
| 2973 | CVE-2025-69079 |
|
16.7th | 9.8 | This vulnerability allows remote attackers to execute arbitrary code through deserialization of untr | |
| 2974 | CVE-2025-69052 |
|
16.9th | 9.8 | This CVE describes a Missing Authorization vulnerability in the Registration & Login with Mobile Pho | |
| 2975 | CVE-2025-68869 |
|
16.9th | 9.8 | This vulnerability allows attackers to escalate privileges in LazyTasks project management software, | |
| 2976 | CVE-2025-67617 |
|
16.7th | 9.8 | CVE-2025-67617 is a PHP object injection vulnerability in the Consult Aid WordPress theme that allow | |
| 2977 | CVE-2026-23958 |
|
16.7th | 9.8 | Dataease versions before 2.10.19 use MD5-hashed passwords as JWT signing secrets, allowing attackers | |
| 2978 | CVE-2026-23800 |
|
16.9th | 10.0 | This vulnerability allows attackers to escalate privileges in Modular DS modular-connector WordPress | |
| 2979 | CVE-2026-22907 |
|
16.9th | 9.9 | This critical vulnerability allows attackers to bypass security controls and access the host filesys | |
| 2980 | CVE-2022-50935 |
|
16.9th | 9.8 | CVE-2022-50935 is an unquoted service path vulnerability in the Flame II HSPA USB Modem software for | |
| 2981 | CVE-2025-62616 |
|
16.7th | 9.8 | This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in AutoGPT's SendDiscordFileBl | |
| 2982 | CVE-2025-62615 |
|
16.7th | 9.8 | This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in AutoGPT's RSSFeedBlock comp | |
| 2983 | CVE-2026-25202 |
|
16.9th | 9.8 | MagicINFO 9 Server versions below 21.1090.1 contain hardcoded database credentials, allowing attacke | |
| 2984 | CVE-2025-25306 |
|
16.4th | 9.3 | This vulnerability in Misskey allows attackers to forge ActivityPub objects by manipulating the rela | |
| 2985 | CVE-2025-3755 |
|
16.3th | 9.1 | A critical vulnerability in Mitsubishi Electric MELSEC iQ-F Series CPU modules allows remote unauthe | |
| 2986 | CVE-2025-47599 |
|
16.4th | 9.3 | This SQL injection vulnerability in the Facturante WordPress plugin allows attackers to execute arbi | |
| 2987 | CVE-2025-46539 |
|
16.4th | 9.3 | This SQL injection vulnerability in the WPFable Fable Extra WordPress plugin allows attackers to exe | |
| 2988 | CVE-2025-46460 |
|
16.4th | 9.3 | This SQL injection vulnerability in the Detheme Easy Guide WordPress plugin allows attackers to exec | |
| 2989 | CVE-2025-46455 |
|
16.4th | 9.3 | This SQL injection vulnerability in WP HRM LITE WordPress plugin allows attackers to execute arbitra | |
| 2990 | CVE-2025-31914 |
|
16.4th | 9.3 | This SQL injection vulnerability in the Pixel WordPress Form BuilderPlugin & Autoresponder allows at | |
| 2991 | CVE-2025-31056 |
|
16.4th | 9.3 | This SQL injection vulnerability in the WhatsCart WordPress plugin allows attackers to execute arbit | |
| 2992 | CVE-2025-40925 |
|
16.5th | 9.1 | This vulnerability in Starch versions 0.14 and earlier allows attackers to predict session IDs due t | |
| 2993 | CVE-2026-26021 |
|
16.4th | 9.8 | CVE-2026-26021 is a prototype pollution vulnerability in the npm package set-in that allows attacker | |
| 2994 | CVE-2025-59557 |
|
16.3th | 9.3 | This CVE describes an SQL injection vulnerability in the ThemeMove Learts Addons WordPress plugin, a | |
| 2995 | CVE-2025-49931 |
|
16.3th | 9.3 | This SQL injection vulnerability in the CrocoBlock JetSearch WordPress plugin allows attackers to ex | |
| 2996 | CVE-2025-49915 |
|
16.3th | 9.3 | This SQL injection vulnerability in the Cozy Vision SMS Alert Order Notifications WordPress plugin a | |
| 2997 | CVE-2025-69559 |
|
16.5th | 9.8 | Computer Book Store 1.0 contains an unrestricted file upload vulnerability in admin_add.php that all | |
| 2998 | CVE-2025-68018 |
|
16.5th | 9.4 | A missing authorization vulnerability in the Order Listener for WooCommerce plugin allows attackers | |
| 2999 | CVE-2025-70968 |
|
16.5th | 9.8 | FreeImage 3.18.0 contains a use-after-free vulnerability in the TARGA image parser that allows attac | |
| 3000 | CVE-2025-64420 |
|
16.5th | 9.9 | This vulnerability allows low-privileged users in Coolify to view the root user's private SSH key, e |
What is EPSS?
The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation — making it ideal for prioritizing which vulnerabilities to patch first.
Why EPSS matters: With thousands of CVEs published monthly, not all vulnerabilities are equally dangerous. EPSS helps security teams focus on the CVEs most likely to be actively exploited, rather than patching solely by CVSS score. A critical CVSS 9.8 vulnerability with 0.1% EPSS may be less urgent than a high CVSS 7.5 with 90% EPSS.
Prioritize by Exploit Risk
Scan your servers and see which vulnerabilities have the highest EPSS scores. Focus on what attackers are actually targeting.
Start Monitoring Free