Login Sign Up

Most Exploitable CVEs - EPSS Rankings

CVEs ranked by EPSS (Exploit Prediction Scoring System) probability. Higher scores mean a greater likelihood of exploitation in the wild within the next 30 days.

164
EPSS > 50%
156
CISA KEV Listed
35,468
CVEs with EPSS
0.7%
Avg EPSS Score
All Critical High Medium Low
Rank CVE ID EPSS Score Percentile CVSS Flags Summary
1 CVE-2024-50603
94.35%
100th 10.0 KEV This is a critical command injection vulnerability in Aviatrix Controller that allows unauthenticate
2 CVE-2025-24813
94.18%
99.9th 9.8 KEV This vulnerability in Apache Tomcat allows path traversal attacks via internal dot handling in filen
3 CVE-2024-55591
94.16%
99.9th 9.8 KEV This vulnerability allows remote attackers to bypass authentication and gain super-admin privileges
4 CVE-2025-0282
94.12%
99.9th 9.0 KEV A stack-based buffer overflow vulnerability in Ivanti Connect Secure, Policy Secure, and Neurons for
5 CVE-2025-0108
94.01%
99.9th 9.1 KEV An authentication bypass vulnerability in Palo Alto Networks PAN-OS software allows unauthenticated
6 CVE-2024-13159
93.91%
99.9th 9.8 KEV CVE-2024-13159 is an absolute path traversal vulnerability in Ivanti Endpoint Manager (EPM) that all
7 CVE-2024-32640
93.72%
99.8th 9.8 CVE-2024-32640 is a critical SQL injection vulnerability in MASA CMS that allows attackers to execut
8 CVE-2025-29927
92.9%
99.8th 9.1 This CVE describes an authorization bypass vulnerability in Next.js middleware. Attackers can bypass
9 CVE-2025-47812
92.47%
99.7th 10.0 KEV CVE-2025-47812 is a critical remote code execution vulnerability in Wing FTP Server that allows atta
10 CVE-2025-3248
91.97%
99.7th 9.8 KEV CVE-2025-3248 is an unauthenticated remote code execution vulnerability in Langflow's /api/v1/valida
11 CVE-2025-49113
91.84%
99.7th 9.9 CVE-2025-49113 is a critical remote code execution vulnerability in Roundcube Webmail affecting auth
12 CVE-2025-1661
91.45%
99.7th 9.8 This vulnerability allows unauthenticated attackers to perform Local File Inclusion (LFI) via the 't
13 CVE-2025-1974
90.65%
99.6th 9.8 CVE-2025-1974 is a critical vulnerability in Kubernetes' ingress-nginx controller that allows unauth
14 CVE-2025-47916
89.99%
99.6th 10.0 This vulnerability allows unauthenticated remote attackers to execute arbitrary PHP code on Invision
15 CVE-2018-1160
89.73%
99.6th 9.8 CVE-2018-1160 is a critical vulnerability in Netatalk that allows remote unauthenticated attackers t
16 CVE-2024-13161
89.6%
99.5th 9.8 KEV This vulnerability allows remote unauthenticated attackers to perform absolute path traversal attack
17 CVE-2025-53770
89.2%
99.5th 9.8 KEV CVE-2025-53770 is a critical deserialization vulnerability in on-premises Microsoft SharePoint Serve
18 CVE-2025-64446
89.02%
99.5th 9.8 KEV A relative path traversal vulnerability in Fortinet FortiWeb web application firewalls allows attack
19 CVE-2025-0107
88.63%
99.5th 9.8 An unauthenticated OS command injection vulnerability in Palo Alto Networks Expedition allows attack
20 CVE-2025-61882
88.1%
99.5th 9.8 KEV This critical vulnerability in Oracle E-Business Suite's Concurrent Processing component allows unau
21 CVE-2025-31161
87.97%
99.5th 9.8 KEV This critical authentication bypass vulnerability in CrushFTP allows unauthenticated attackers to ga
22 CVE-2025-30406
87.94%
99.5th 9.0 KEV This vulnerability in Gladinet CentreStack allows remote code execution through deserialization atta
23 CVE-2024-43468
87.46%
99.4th 9.8 KEV CVE-2024-43468 is a critical SQL injection vulnerability in Microsoft Configuration Manager that all
24 CVE-2025-2746
87.41%
99.4th 9.8 KEV An authentication bypass vulnerability in Kentico Xperience's Staging Sync Server allows attackers t
25 CVE-2024-55556
86.87%
99.4th 9.8 CVE-2024-55556 is a critical remote command execution vulnerability in Crater Invoice that allows un
26 CVE-2020-36847
86.14%
99.4th 9.8 This vulnerability allows unauthenticated attackers to rename uploaded PHP files with .png extension
27 CVE-2025-1302
85.81%
99.4th 9.8 CVE-2025-1302 is a critical Remote Code Execution vulnerability in jsonpath-plus versions before 10.
28 CVE-2025-11749
85.41%
99.3th 9.8 The AI Engine WordPress plugin exposes bearer tokens through an unauthenticated REST API endpoint wh
29 CVE-2025-29306
85.32%
99.3th 9.8 This vulnerability allows remote attackers to execute arbitrary code on FoxCMS v1.2.5 systems throug
30 CVE-2025-1316
84.88%
99.3th 9.8 KEV The Edimax IC-7100 network camera has an OS command injection vulnerability (CWE-78) that allows rem
31 CVE-2025-59528
84.07%
99.3th 10.0 Flowise versions 3.0.5 and below contain a critical remote code execution vulnerability in the Custo
32 CVE-2026-24061
83.89%
99.3th 9.8 KEV This vulnerability in GNU Inetutils telnetd allows remote attackers to bypass authentication by sett
33 CVE-2025-52691
82.72%
99.2th 10.0 KEV This critical vulnerability allows unauthenticated attackers to upload arbitrary files to any locati
34 CVE-2016-15043
82.52%
99.2th 9.8 The WP Mobile Detector WordPress plugin allows unauthenticated attackers to upload arbitrary files d
35 CVE-2025-13315
82.37%
99.2th 9.8 CVE-2025-13315 is an authentication bypass vulnerability in Twonky Server that allows unauthenticate
36 CVE-2025-61757
82.16%
99.2th 9.8 KEV This critical vulnerability in Oracle Identity Manager allows unauthenticated attackers to remotely
37 CVE-2024-46506
82.13%
99.2th 10.0 CVE-2024-46506 is an unauthenticated remote command injection vulnerability in NetAlertX that allows
38 CVE-2019-25224
78.83%
99th 9.8 This vulnerability allows unauthenticated attackers to execute arbitrary operating system commands o
39 CVE-2025-26319
78.8%
99th 9.8 FlowiseAI Flowise v2.2.6 contains an arbitrary file upload vulnerability in the /api/v1/attachments
40 CVE-2024-11613
78.73%
99th 9.8 This vulnerability in the WordPress File Upload plugin allows unauthenticated attackers to execute a
41 CVE-2025-13486
78.45%
99th 9.8 This vulnerability allows unauthenticated attackers to execute arbitrary code on WordPress sites run
42 CVE-2025-2945
77.9%
99th 9.9 This CVE describes a critical remote code execution vulnerability in pgAdmin 4 where attacker-contro
43 CVE-2025-27520
77.82%
99th 9.8 CVE-2025-27520 is a critical remote code execution vulnerability in BentoML caused by insecure deser
44 CVE-2025-40551
77.66%
99th 9.8 KEV SolarWinds Web Help Desk has an unauthenticated remote code execution vulnerability via untrusted da
45 CVE-2024-46310
77.52%
99th 9.1 This vulnerability allows unauthenticated attackers to read and modify arbitrary user data in Cfx.re
46 CVE-2025-32432
77.38%
98.9th 10.0 CVE-2025-32432 is a critical remote code execution vulnerability in Craft CMS that allows attackers
47 CVE-2025-21298
76.87%
98.9th 9.8 This critical vulnerability in Windows OLE (Object Linking and Embedding) allows remote attackers to
48 CVE-2012-10054
75.94%
98.9th 9.8 This vulnerability allows unauthenticated attackers to upload and execute arbitrary ASPX scripts on
49 CVE-2013-10051
75.81%
98.9th 9.8 This CVE describes a critical remote code execution vulnerability in InstantCMS versions 1.6 and ear
50 CVE-2024-57045
74.5%
98.8th 9.8 This critical vulnerability in D-Link DIR-859 routers allows attackers to bypass authentication by f

What is EPSS?

The Exploit Prediction Scoring System (EPSS) is a data-driven model developed by FIRST.org that estimates the probability a CVE will be exploited in the wild within the next 30 days. Unlike CVSS which measures severity, EPSS measures likelihood of exploitation — making it ideal for prioritizing which vulnerabilities to patch first.

Why EPSS matters: With thousands of CVEs published monthly, not all vulnerabilities are equally dangerous. EPSS helps security teams focus on the CVEs most likely to be actively exploited, rather than patching solely by CVSS score. A critical CVSS 9.8 vulnerability with 0.1% EPSS may be less urgent than a high CVSS 7.5 with 90% EPSS.

Prioritize by Exploit Risk

Scan your servers and see which vulnerabilities have the highest EPSS scores. Focus on what attackers are actually targeting.

Start Monitoring Free