Most Exploitable CVEs - EPSS Rankings
CVEs ranked by EPSS (Exploit Prediction Scoring System) probability. Higher scores mean a greater likelihood of exploitation in the wild within the next 30 days.
164
EPSS > 50%
156
CISA KEV Listed
35,468
CVEs with EPSS
0.7%
Avg EPSS Score
| Rank | CVE ID | EPSS Score | Percentile | CVSS | Flags | Summary |
|---|---|---|---|---|---|---|
| 3901 | CVE-2025-12447 |
|
24.3th | 4.2 | This vulnerability allows attackers to spoof the Chrome Omnibox (address bar) security UI on Android | |
| 3902 | CVE-2025-12444 |
|
24.3th | 4.2 | This vulnerability allows attackers to spoof user interface elements in Chrome's fullscreen mode by | |
| 3903 | CVE-2025-61823 |
|
24.4th | 6.2 | This XXE vulnerability in Adobe ColdFusion allows high-privileged attackers to read arbitrary files | |
| 3904 | CVE-2025-65288 |
|
24.4th | 6.5 | A buffer overflow vulnerability in Mercury MR816v2 routers allows attackers to crash devices or pote | |
| 3905 | CVE-2026-1675 |
|
24.5th | 5.3 | The Advanced Country Blocker WordPress plugin has an authorization bypass vulnerability that allows | |
| 3906 | CVE-2024-13340 |
|
24.2th | 6.4 | The MDTF WordPress plugin has a stored XSS vulnerability in its 'mdf_results_by_ajax' shortcode that | |
| 3907 | CVE-2024-57776 |
|
24.3th | 4.6 | This cross-site scripting (XSS) vulnerability in JFinalOA allows attackers to inject malicious scrip | |
| 3908 | CVE-2024-13309 |
|
24.1th | 5.4 | This vulnerability in Drupal's Login Disable module allows attackers to bypass authentication contro | |
| 3909 | CVE-2024-10563 |
|
24.3th | 5.4 | This vulnerability in the WooCommerce Cart Count Shortcode WordPress plugin allows users with contri | |
| 3910 | CVE-2024-12308 |
|
24.3th | 5.4 | The Logo Slider WordPress plugin before version 4.6.0 has a stored cross-site scripting (XSS) vulner | |
| 3911 | CVE-2024-31068 |
|
24.1th | 5.3 | This vulnerability involves improper finite state machine implementation in hardware logic for certa | |
| 3912 | CVE-2025-24532 |
|
24.2th | 4.3 | This vulnerability affects Siemens SCALANCE industrial wireless devices with SNMPv3 configured. It a | |
| 3913 | CVE-2024-44449 |
|
24.3th | 6.1 | A cross-site scripting (XSS) vulnerability in Quorum onQ OS allows remote attackers to inject malici | |
| 3914 | CVE-2025-24202 |
|
24.2th | 5.5 | This CVE describes a logging vulnerability in Apple operating systems where insufficient data redact | |
| 3915 | CVE-2025-2921 |
|
24.1th | 6.4 | A critical vulnerability in Netis WF-2404 routers allows attackers to exploit a default password iss | |
| 3916 | CVE-2025-22671 |
|
24.2th | 4.3 | This CVE describes a missing authorization vulnerability in the WordPress 'Disable Elementor Editor | |
| 3917 | CVE-2025-2672 |
|
24.3th | 6.3 | This critical SQL injection vulnerability in Payroll Management System 1.0 allows remote attackers t | |
| 3918 | CVE-2023-43029 |
|
24.2th | 6.8 | IBM Storage Virtualize vSphere Remote Plug-in versions 1.0 and 1.1 expose sensitive credential infor | |
| 3919 | CVE-2024-44314 |
|
24.2th | 6.5 | CVE-2024-44314 is an incorrect access control vulnerability in TastyIgniter 3.7.6 that allows unauth | |
| 3920 | CVE-2025-25925 |
|
24.3th | 4.8 | A stored cross-site scripting (XSS) vulnerability in OpenMRS v2.4.3 Build 0ff0ed allows attackers to | |
| 3921 | CVE-2025-27436 |
|
24.3th | 4.3 | This vulnerability in SAP S/4HANA's Manage Bank Statements function allows authenticated users to de | |
| 3922 | CVE-2025-27433 |
|
24.3th | 4.3 | This vulnerability in SAP S/4HANA's Manage Bank Statements functionality allows authenticated users | |
| 3923 | CVE-2025-26656 |
|
24.3th | 4.3 | This vulnerability in SAP's Manage Purchasing Info Records OData service allows authenticated users | |
| 3924 | CVE-2025-27418 |
|
24.3th | 5.4 | This stored XSS vulnerability in WeGIA allows attackers to inject malicious scripts via the tipo par | |
| 3925 | CVE-2024-53386 |
|
24.3th | 4.9 | CVE-2024-53386 is a DOM clobbering vulnerability in Stage.js that allows attackers to inject HTML el | |
| 3926 | CVE-2025-23137 |
|
24.2th | 5.5 | This CVE describes a NULL pointer dereference vulnerability in the Linux kernel's AMD CPU frequency | |
| 3927 | CVE-2025-46078 |
|
24.1th | 5.3 | HuoCMS V3.5.1 and earlier contains an unrestricted file upload vulnerability that allows attackers t | |
| 3928 | CVE-2025-48138 |
|
24.1th | 4.3 | This CVE describes a missing authorization vulnerability in the BERTHA AI WordPress plugin that allo | |
| 3929 | CVE-2025-4530 |
|
24.2th | 4.3 | This CVE describes a path traversal vulnerability in the feng_ha_ha/megagao ssm-erp and production_s | |
| 3930 | CVE-2025-47612 |
|
24.1th | 5.4 | This CVE describes a Missing Authorization vulnerability in the ClickWhale WordPress plugin that all | |
| 3931 | CVE-2025-46719 |
|
24.2th | 5.4 | Open WebUI versions before 0.6.6 contain a stored cross-site scripting (XSS) vulnerability where att | |
| 3932 | CVE-2025-6534 |
|
24.1th | 4.2 | This vulnerability in novel-plus allows remote attackers to delete arbitrary files due to missing au | |
| 3933 | CVE-2025-6517 |
|
24.1th | 6.3 | This critical Server-Side Request Forgery (SSRF) vulnerability in Dromara MaxKey allows attackers to | |
| 3934 | CVE-2025-49187 |
|
24.3th | 5.3 | This vulnerability allows attackers to enumerate valid usernames by observing different error messag | |
| 3935 | CVE-2025-7208 |
|
24.3th | 5.5 | A critical heap-based buffer overflow vulnerability exists in the edump function of plan9port's x509 | |
| 3936 | CVE-2025-7507 |
|
24.3th | 6.4 | The elink Embed Content WordPress plugin up to version 1.1.0 allows authenticated attackers with Con | |
| 3937 | CVE-2025-10770 |
|
24.2th | 6.3 | This vulnerability allows remote attackers to exploit a deserialization flaw in jeecgboot JimuReport | |
| 3938 | CVE-2025-53609 |
|
24.2th | 4.9 | A relative path traversal vulnerability in FortiWeb web application firewalls allows authenticated a | |
| 3939 | CVE-2024-56189 |
|
24.1th | 6.5 | This vulnerability allows authenticated remote attackers to read memory beyond intended boundaries i | |
| 3940 | CVE-2025-60711 |
|
24.1th | 6.3 | A protection mechanism failure in Microsoft Edge (Chromium-based) allows unauthorized attackers to e | |
| 3941 | CVE-2025-10310 |
|
24.1th | 4.9 | This SQL injection vulnerability in the Rich Snippet Site Report WordPress plugin allows unauthentic | |
| 3942 | CVE-2025-61319 |
|
24.3th | 6.1 | ReNgine versions through 2.2.0 contain a stored XSS vulnerability in the Vulnerabilities module. Whe | |
| 3943 | CVE-2025-58181 |
|
24.2th | 5.3 | This vulnerability in SSH servers allows attackers to cause denial of service through memory exhaust | |
| 3944 | CVE-2025-64504 |
|
24.2th | 5.0 | This vulnerability in Langfuse allows authenticated users to enumerate names and email addresses of | |
| 3945 | CVE-2025-67170 |
|
24.1th | 6.1 | A reflected cross-site scripting vulnerability in RiteCMS v3.1.0 allows attackers to inject maliciou | |
| 3946 | CVE-2025-14304 |
|
24.3th | 6.8 | This vulnerability allows unauthenticated physical attackers with DMA-capable PCIe devices to read a | |
| 3947 | CVE-2025-68150 |
|
24.1th | 6.5 | Parse Server's Instagram authentication adapter allows attackers to specify custom API URLs, enablin | |
| 3948 | CVE-2025-64052 |
|
24.1th | 5.1 | This vulnerability allows unauthenticated attackers on the same local network to execute arbitrary s | |
| 3949 | CVE-2025-27451 |
|
24.3th | 5.3 | This vulnerability allows attackers to enumerate valid usernames by observing different error messag | |
| 3950 | CVE-2024-25709 |
|
24.2th | 6.1 | A stored XSS vulnerability in Esri Portal for ArcGIS allows remote authenticated attackers to inject |
What is EPSS?
The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation — making it ideal for prioritizing which vulnerabilities to patch first.
Why EPSS matters: With thousands of CVEs published monthly, not all vulnerabilities are equally dangerous. EPSS helps security teams focus on the CVEs most likely to be actively exploited, rather than patching solely by CVSS score. A critical CVSS 9.8 vulnerability with 0.1% EPSS may be less urgent than a high CVSS 7.5 with 90% EPSS.
Prioritize by Exploit Risk
Scan your servers and see which vulnerabilities have the highest EPSS scores. Focus on what attackers are actually targeting.
Start Monitoring Free