Skip to content
THREATWIRE

CVE Tracker

Top EPSS

The CVEs in the tracker with the highest estimated chance of being exploited in the next 30 days.

CVSS is severity: how bad it could be. EPSS is likelihood: a statistical probability that exploitation is seen in the next 30 days. KEV means CISA has confirmed it is already exploited. EPSS is a probability, not a certainty.

Source: FIRST EPSS, scores of 16 Oct 2026. Tracker data last updated 17 Oct 2026. Covers only the CVEs in the ThreatWire tracker. Search the full tracker

Top 50 by EPSS

  1. 1CVE-2025-53770EPSS 100%percentile 99thNo CVSSKEV

    Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

    Microsoft / SharePoint

  2. 2CVE-2024-7593EPSS 100%percentile 99thNo CVSSKEV

    Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

    Ivanti / Virtual Traffic Manager

  3. 3CVE-2024-3400EPSS 100%percentile 99thCVSS 10.0 criticalKEVActive exploitation

    Palo Alto Networks PAN-OS Command Injection Vulnerability

    Palo Alto Networks / PAN-OS

  4. 4CVE-2024-23897EPSS 100%percentile 99thNo CVSSKEV

    Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

    Jenkins / Jenkins Command Line Interface (CLI)

  5. 5CVE-2024-21893EPSS 100%percentile 99thNo CVSSKEV

    Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability

    Ivanti / Connect Secure, Policy Secure, and Neurons

  6. 6CVE-2024-21887EPSS 100%percentile 99thNo CVSSKEV

    Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

    Ivanti / Connect Secure and Policy Secure

  7. 7CVE-2023-4966EPSS 100%percentile 99thNo CVSSKEV

    Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability

    Citrix / NetScaler ADC and NetScaler Gateway

  8. 8CVE-2023-44487EPSS 100%percentile 99thNo CVSSKEV

    HTTP/2 Rapid Reset Attack Vulnerability

    IETF / HTTP/2

  9. 9CVE-2023-35082EPSS 100%percentile 99thNo CVSSKEV

    Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability

    Ivanti / Endpoint Manager Mobile (EPMM) and MobileIron Core

  10. 10CVE-2023-35078EPSS 100%percentile 99thNo CVSSKEV

    Ivanti Endpoint Manager Mobile Authentication Bypass Vulnerability

    Ivanti / Endpoint Manager Mobile (EPMM)

  11. 11CVE-2023-32315EPSS 100%percentile 99thNo CVSSKEV

    Ignite Realtime Openfire Path Traversal Vulnerability

    Ignite Realtime / Openfire

  12. 12CVE-2023-27350EPSS 100%percentile 99thNo CVSSKEV

    PaperCut MF/NG Improper Access Control Vulnerability

    PaperCut / MF/NG

  13. 13CVE-2023-22518EPSS 100%percentile 99thNo CVSSKEV

    Atlassian Confluence Data Center and Server Improper Authorization Vulnerability

    Atlassian / Confluence Data Center and Server

  14. 14CVE-2023-1671EPSS 100%percentile 99thNo CVSSKEV

    Sophos Web Appliance Command Injection Vulnerability

    Sophos / Web Appliance

  15. 15CVE-2023-1389EPSS 100%percentile 99thNo CVSSKEV

    TP-Link Archer AX-21 Command Injection Vulnerability

    TP-Link / Archer AX21

  16. 16CVE-2023-0669EPSS 100%percentile 99thNo CVSSKEV

    Fortra GoAnywhere MFT Remote Code Execution Vulnerability

    Fortra / GoAnywhere MFT

  17. 17CVE-2022-29464EPSS 100%percentile 99thNo CVSSKEV

    WSO2 Multiple Products Unrestrictive Upload of File Vulnerability

    WSO2 / Multiple Products

  18. 18CVE-2022-26134EPSS 100%percentile 99thNo CVSSKEV

    Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability

    Atlassian / Confluence Server/Data Center

  19. 19CVE-2021-44228EPSS 100%percentile 99thCVSS 10.0 criticalKEVActive exploitation

    Apache Log4j2 Remote Code Execution Vulnerability

    Apache / Log4j2

  20. 20CVE-2021-40438EPSS 100%percentile 99thNo CVSSKEV

    Apache HTTP Server-Side Request Forgery (SSRF)

    Apache / Apache

  21. 21CVE-2021-35464EPSS 100%percentile 99thNo CVSSKEV

    ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability

    ForgeRock / Access Management (AM)

  22. 22CVE-2021-34473EPSS 100%percentile 99thNo CVSSKEV

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft / Exchange Server

  23. 23CVE-2021-26086EPSS 100%percentile 99thNo CVSSKEV

    Atlassian Jira Server and Data Center Path Traversal Vulnerability

    Atlassian / Jira Server and Data Center

  24. 24CVE-2021-26084EPSS 100%percentile 99thNo CVSSKEV

    Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability

    Atlassian / Confluence Server and Data Center

  25. 25CVE-2021-22005EPSS 100%percentile 99thNo CVSSKEV

    VMware vCenter Server File Upload Vulnerability

    VMware / vCenter Server

  26. 26CVE-2021-21985EPSS 100%percentile 99thNo CVSSKEV

    VMware vCenter Server Improper Input Validation Vulnerability

    VMware / vCenter Server

  27. 27CVE-2021-1498EPSS 100%percentile 99thNo CVSSKEV

    Cisco HyperFlex HX Data Platform Command Injection Vulnerability

    Cisco / HyperFlex HX

  28. 28CVE-2020-5902EPSS 100%percentile 99thNo CVSSKEV

    F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution Vulnerability

    F5 / BIG-IP

  29. 29CVE-2019-19781EPSS 100%percentile 99thNo CVSSKEV

    Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution Vulnerability

    Citrix / Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance

  30. 30CVE-2019-11510EPSS 100%percentile 99thNo CVSSKEV

    Ivanti Pulse Connect Secure Arbitrary File Read Vulnerability

    Ivanti / Pulse Connect Secure

  31. 31CVE-2019-0708EPSS 100%percentile 99thNo CVSSKEV

    Microsoft Remote Desktop Services Remote Code Execution Vulnerability

    Microsoft / Remote Desktop Services

  32. 32CVE-2018-13379EPSS 100%percentile 99thNo CVSSKEV

    Fortinet FortiOS SSL VPN Path Traversal Vulnerability

    Fortinet / FortiOS

  33. 33CVE-2017-9841EPSS 100%percentile 99thNo CVSSKEV

    PHPUnit Command Injection Vulnerability

    PHPUnit / PHPUnit

  34. 34CVE-2017-5638EPSS 100%percentile 99thNo CVSSKEV

    Apache Struts Remote Code Execution Vulnerability

    Apache / Struts

  35. 35CVE-2015-1635EPSS 100%percentile 99thNo CVSSKEV

    Microsoft HTTP.sys Remote Code Execution Vulnerability

    Microsoft / HTTP.sys

  36. 36CVE-2014-6271EPSS 100%percentile 99thNo CVSSKEV

    GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

    GNU / Bourne-Again Shell (Bash)

  37. 37CVE-2014-0160EPSS 100%percentile 99thNo CVSSKEV

    OpenSSL Information Disclosure Vulnerability

    OpenSSL / OpenSSL

  38. 38CVE-2022-22954EPSS 100%percentile 99thNo CVSSKEV

    VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability

    VMware / Workspace ONE Access and Identity Manager

  39. 39CVE-2017-7921EPSS 100%percentile 99thNo CVSSKEV

    Hikvision Multiple Products Improper Authentication Vulnerability

    Hikvision / Multiple Products

  40. 40CVE-2013-2251EPSS 100%percentile 99thNo CVSSKEV

    Apache Struts Improper Input Validation Vulnerability

    Apache / Struts

  41. 41CVE-2012-1823EPSS 100%percentile 99thNo CVSSKEV

    PHP-CGI Query String Parameter Vulnerability

    PHP / PHP

  42. 42CVE-2024-3273EPSS 100%percentile 99thNo CVSSKEV

    D-Link Multiple NAS Devices Command Injection Vulnerability

    D-Link / Multiple NAS Devices

  43. 43CVE-2020-14882EPSS 100%percentile 99thNo CVSSKEV

    Oracle WebLogic Server Remote Code Execution Vulnerability

    Oracle / WebLogic Server

  44. 44CVE-2021-26855EPSS 100%percentile 99thNo CVSSKEV

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Microsoft / Exchange Server

  45. 45CVE-2019-16920EPSS 100%percentile 99thNo CVSSKEV

    D-Link Multiple Routers Command Injection Vulnerability

    D-Link / Multiple Routers

  46. 46CVE-2025-49704EPSS 100%percentile 99thNo CVSSKEV

    Microsoft SharePoint Code Injection Vulnerability

    Microsoft / SharePoint

  47. 47CVE-2022-44877EPSS 100%percentile 99thNo CVSSKEV

    CWP Control Web Panel OS Command Injection Vulnerability

    CWP / Control Web Panel

  48. 48CVE-2024-34102EPSS 100%percentile 99thNo CVSSKEV

    Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) Vulnerability

    Adobe / Commerce and Magento Open Source

  49. 49CVE-2017-10271EPSS 100%percentile 99thNo CVSSKEV

    Oracle Corporation WebLogic Server Remote Code Execution Vulnerability

    Oracle / WebLogic Server

  50. 50CVE-2025-3248EPSS 100%percentile 99thNo CVSSKEV

    Langflow Missing Authentication Vulnerability

    Langflow / Langflow