Bulk EPSS Score Lookup

Paste up to 1,000 CVE IDs and see which ones are most likely to be exploited

What is EPSS? The Exploit Prediction Scoring System, published daily through FIRST, estimates the probability that a CVE will see exploitation activity in the next 30 days. CVSS rates how bad a flaw is. EPSS estimates how likely attackers are to use it.

How to read the results

EPSS probability is the model's estimate, from 0% to 100%, that exploitation activity against the CVE is observed in the next 30 days.

Percentile is where the CVE ranks against every other scored CVE. A 95th-percentile CVE has a higher EPSS score than 95% of all scored CVEs.

Use EPSS alongside CVSS and the CISA KEV catalog. A CVE in KEV has confirmed exploitation in the wild. Prioritize it whatever its EPSS score says. A CVE with no score is usually too new for today's scoring run, reserved or rejected, or a mistyped ID.

Data from the FIRST EPSS API. Only the CVE IDs found in your text are sent, from your browser straight to FIRST's API. FixTheVuln never receives them. Scoring a whole scanner export? FIRST publishes every score as a daily CSV download, which suits large lists better than this API.

Related Resources

🧮 CVSS Calculator Calculate vulnerability severity scores 🎯 Exploit Tracker Recently exploited vulnerabilities 📋 Vulnerability Tracking Prioritize and track remediation
← Back to Tools

FixTheVuln Store

Patch Tuesday Sprint Kit

Free fillable templates for patch triage, with an EPSS column in the Monthly Triage Matrix. $4.99/mo for a kit pre-filled with each cycle's CISA KEV data.

Try Free Templates