Exploit forecast
Exploit weather, next 30 days
The newest CVEs, ranked by the chance someone will actually exploit them.
Loading the forecast...
EPSS vs CVSS
CVSS says how bad a flaw could be if it is exploited: a technical severity from 0 to 10. EPSS says how likely exploitation is in the next 30 days: a probability from 0 to 100%, re-estimated daily from real-world signals. A flaw can be a 9.8 on CVSS and still sit at 0.1% on EPSS, and a modest 6.5 can carry a 60% chance. Use CVSS for impact, EPSS for urgency, and look at both.
Brand-new CVEs often have no EPSS score yet, so they show as "not scored yet" rather than a guess.
Data sources & privacy
This page loads one small pre-computed file from this site's data service. The latest CVE records (from CIRCL) and their scores (from FIRST) are fetched on the server, so neither service sees your IP address. No input of yours is sent anywhere.
EPSS is published by FIRST, the CVE data comes from CIRCL's public feed. All values are treated as untrusted and shown as plain text. Nothing is stored. A probability is a forecast, not a verdict.