Docs
Open Lodol
DocumentationIntegrationsAPI

EPSS

App · Compliance & Security · 8 actions

Work with EPSS, the Exploit Prediction Scoring System published by FIRST: a daily estimate, for every CVE, of how likely it is to be exploited in the wild in the next 30 days. Feed it a scanner export or a ticket queue and get the findings back ranked by real-world risk instead of by severity, watch a CVE's score climb as exploit code appears, see the highest-risk CVEs of the week, and export any of it as CSV. No account or API key required.

Actions

ActionWhat it does
Browse EPSS scoresBrowse the whole scored set through every filter it can be narrowed by: a probability range, a percentile range, a CVE ID fragment, and the day the scores were published.
Export scores as CSVExport matching scores as CSV, ready to attach to a ticket or drop into a spreadsheet.
Get a CVE's exploit probabilityRead one CVE's current EPSS score: the chance it is exploited somewhere in the world in the next 30 days, where that ranks against every other scored CVE, and a plain English sentence saying both.
Get a CVE's score historySee how one CVE's exploit probability has moved over the past month, with the day it started, the day it peaked and where it stands now.
Get scoring detailsRead which day's scores are current, how many CVEs FIRST has scored, and how they are spread across the four likelihood bands.
List recently scored CVEsList the CVEs FIRST has newly scored or rescored in the last few days, so a scheduled workflow can report what changed since it last ran.
List the highest-risk CVEsList the CVEs most likely to be exploited right now, across everything FIRST scores, highest first.
Score and rank a list of CVEsTake a list of CVE IDs - a scanner export, a ticket queue, a vendor advisory - and get them back ordered by how likely each one is to be exploited in the next 30 days.

Browse EPSS scores

Browse the whole scored set through every filter it can be narrowed by: a probability range, a percentile range, a CVE ID fragment, and the day the scores were published. Order the results and page through them. This is the general-purpose browse action; the others answer one specific question each. No API key required.

Inputs

Scores as ofas_ofdate
Read the scores FIRST published on this day rather than the newest ones. FIRST has published every day since 2021-04-14. Leave it empty for today's scores.
Minimum probability (%)minimum_probabilitynumber
Only CVEs with at least this chance of being exploited in the next 30 days, as a percentage. 10 keeps roughly the top 5% of all scored CVEs. Leave it empty for every probability.From 0 to 100.
Maximum probability (%)maximum_probabilitynumber
Only CVEs at or below this chance of being exploited in the next 30 days, as a percentage. Pair it with the minimum to look at one band at a time. Leave it empty for no upper limit.From 0 to 100.
Minimum percentileminimum_percentilenumber
Only CVEs ranked at or above this percentile of everything FIRST scores, from 0 to 100. 99 means the riskiest one percent. Use this when you want a fixed share of the catalog rather than a fixed probability. Leave it empty for every rank.From 0 to 100.
Maximum percentilemaximum_percentilenumber
Only CVEs ranked at or below this percentile, from 0 to 100. Leave it empty for no upper limit.From 0 to 100.
CVE ID containscve_containstext
Only CVEs whose identifier contains this text. It matches the ID alone: FIRST publishes a score and nothing else about a CVE, so there is no product or description here to search. FIRST also matches each part of the ID separately rather than the whole string, so '2021' finds CVE-2021-1234 and CVE-2011-2021 alike, and '44228' finds that number in any year.
Order bysorttext
How to order the results. Most likely to be exploited first by default.One of: probability_desc (Most likely to be exploited first), probability_asc (Least likely to be exploited first), cve_desc (Newest CVE ID first), cve_asc (Oldest CVE ID first). Default: probability_desc.
Maximum resultslimitnumber
How many CVEs to return. The answer also carries the total number that matched, so a capped list never reads as a complete one.From 1 to 500. Default: 25.
Skipoffsetnumber
How many matching CVEs to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 10000. Default: 0.

Outputs

as_oftext
The day that was asked for, or empty when the newest scores were read.
countnumber
How many CVEs this step returned.
offsetnumber
How many matches were skipped before this page.
retrieved_attext
When this step read the API, in UTC.
score_datetext
The day these scores were published, as YYYY-MM-DD. FIRST rescores every CVE daily, so an answer is only reproducible alongside its day.
scoreslist
The matching CVEs, in the order asked for.
sorttext
The order the CVEs came back in.
total_countnumber
How many CVEs matched in all, before the limit was applied.
truncatedtrue/false
True when matches were left out by the limit.
Example output
{
  "as_of": "2026-09-03",
  "count": 2,
  "offset": 0,
  "retrieved_at": "2026-09-03T19:05:57Z",
  "score_date": "2026-09-03",
  "scores": [
    {
      "cve": "CVE-2021-44228",
      "date": "2026-09-03",
      "epss": 0.99999,
      "epss_percent": 99.999,
      "likelihood": "very_high",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "percentile": 1.0,
      "percentile_rank": 100.0,
      "summary": "CVE-2021-44228 has a 100% chance of exploitation in the next 30 days, which puts it at the 100% percentile of all scored CVEs."
    },
    {
      "cve": "CVE-2026-9854",
      "date": "2026-09-03",
      "epss": 0.00122,
      "epss_percent": 0.122,
      "likelihood": "low",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9854",
      "percentile": 0.02245,
      "percentile_rank": 2.245,
      "summary": "CVE-2026-9854 has a 0.122% chance of exploitation in the next 30 days, which puts it at the 2.24% percentile of all scored CVEs."
    }
  ],
  "sort": "probability_desc",
  "total_count": 367633,
  "truncated": true
}

Export scores as CSV

Export matching scores as CSV, ready to attach to a ticket or drop into a spreadsheet. Each row carries the CVE, its probability as both a fraction and a percentage, its percentile, its band and a link to the NIST record. No API key required.

Inputs

Scores as ofas_ofdate
Read the scores FIRST published on this day rather than the newest ones. FIRST has published every day since 2021-04-14. Leave it empty for today's scores.
Minimum probability (%)minimum_probabilitynumber
Only CVEs with at least this chance of being exploited in the next 30 days, as a percentage. 10 keeps roughly the top 5% of all scored CVEs. Leave it empty for every probability.From 0 to 100.
Minimum percentileminimum_percentilenumber
Only CVEs ranked at or above this percentile of everything FIRST scores, from 0 to 100. 99 means the riskiest one percent. Use this when you want a fixed share of the catalog rather than a fixed probability. Leave it empty for every rank.From 0 to 100.
CVE ID containscve_containstext
Only CVEs whose identifier contains this text. It matches the ID alone: FIRST publishes a score and nothing else about a CVE, so there is no product or description here to search. FIRST also matches each part of the ID separately rather than the whole string, so '2021' finds CVE-2021-1234 and CVE-2011-2021 alike, and '44228' finds that number in any year.
Order bysorttext
How to order the results. Most likely to be exploited first by default.One of: probability_desc (Most likely to be exploited first), probability_asc (Least likely to be exploited first), cve_desc (Newest CVE ID first), cve_asc (Oldest CVE ID first). Default: probability_desc.
Maximum rowslimitnumber
How many rows to write. The answer also carries how many matched in all, so a capped export never reads as a complete one.From 1 to 5000. Default: 500.

Outputs

columnslist
The column names, in order.
countnumber
How many rows were written.
csvtext
The CSV text, header row first.
retrieved_attext
When this step read the API, in UTC.
score_datetext
The day these scores were published, as YYYY-MM-DD. FIRST rescores every CVE daily, so an answer is only reproducible alongside its day.
sorttext
The order the CVEs came back in.
total_countnumber
How many CVEs matched in all, before the limit was applied.
truncatedtrue/false
True when matches were left out by the limit.
Example output
{
  "columns": [
    "cve",
    "epss",
    "epss_percent",
    "percentile",
    "percentile_rank",
    "likelihood",
    "date",
    "nvd_url"
  ],
  "count": 2,
  "csv": "cve,epss,epss_percent,percentile,percentile_rank,likelihood,date,nvd_url\nCVE-2021-44228,0.99999,99.999,1,100,very_high,2026-09-03,https://nvd.nist.gov/vuln/detail/CVE-2021-44228\nCVE-2026-9854,0.00122,0.122,0.02245,2.245,low,2026-09-03,https://nvd.nist.gov/vuln/detail/CVE-2026-9854\n",
  "retrieved_at": "2026-09-03T19:05:57Z",
  "score_date": "2026-09-03",
  "sort": "probability_desc",
  "total_count": 533,
  "truncated": true
}

Get a CVE's exploit probability

Read one CVE's current EPSS score: the chance it is exploited somewhere in the world in the next 30 days, where that ranks against every other scored CVE, and a plain English sentence saying both. The step fails if FIRST has not scored the CVE yet, so use 'Score and rank a list of CVEs' when you are checking several at once. No API key required.

Inputs

CVE IDcve_idtextRequired
The CVE to look up, such as CVE-2021-44228. Any casing is accepted.

Outputs

cvetext
The CVE identifier, for example 'CVE-2021-44228'.
datetext
The day FIRST published this score, as YYYY-MM-DD.
epssnumber
The probability that this CVE will be exploited somewhere in the world in the next 30 days, from 0 to 1. This is FIRST's own number, as published.
epss_percentnumber
The same probability written as a percentage, from 0 to 100 - the unit every filter on this integration is set in.
likelihoodtext
The probability in one word, for branching a workflow on: 'very_high' at 50% or more, 'high' at 10%, 'medium' at 1%, 'low' below that. The bands are Lodol's reading of the score; FIRST publishes the number without them.
nvd_urltext
This CVE's record in the NIST National Vulnerability Database.
percentilenumber
Where that probability sits among every CVE FIRST scores, from 0 to 1. A CVE at 0.95 is riskier than 95% of all scored CVEs, even if its own probability is small.
percentile_ranknumber
The same rank written as a percentage, from 0 to 100.
summarytext
Both numbers said in plain English, ready to paste into a ticket or a message.
Example output
{
  "cve": "CVE-2021-44228",
  "date": "2026-09-03",
  "epss": 0.99999,
  "epss_percent": 99.999,
  "likelihood": "very_high",
  "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
  "percentile": 1.0,
  "percentile_rank": 100.0,
  "summary": "CVE-2021-44228 has a 100% chance of exploitation in the next 30 days, which puts it at the 100% percentile of all scored CVEs."
}

Get a CVE's score history

See how one CVE's exploit probability has moved over the past month, with the day it started, the day it peaked and where it stands now. A score that has climbed is the signal worth acting on: FIRST rescores daily, and a CVE that was negligible last week and is not now has usually had working exploit code published in between. No API key required.

Inputs

CVE IDcve_idtextRequired
The CVE to trace, such as CVE-2021-44228. Any casing is accepted.
Ending onas_ofdate
End the window on this day instead of today, to see what the score looked like at the time of an incident. FIRST has published every day since 2021-04-14. Leave it empty for the past month.

Outputs

changenumber
How much the probability moved across the window, from -1 to 1. Negative when it fell.
change_percentnumber
The same movement in percentage points, so a rise from 4% to 36% reads as 32.
cvetext
The CVE this history is for.
day_countnumber
How many days of scores came back. FIRST keeps about a month per CVE.
directiontext
'up', 'down' or 'unchanged', for branching a workflow on without doing the arithmetic.
earliestobject
The oldest score in the window.
highestobject
The day the score peaked in the window.
historylist
One entry per day FIRST published a score, oldest first.
latestobject
The most recent score in the window.
lowestobject
The day it was lowest in the window.
nvd_urltext
This CVE's record in the NIST National Vulnerability Database.
retrieved_attext
When this step read the API, in UTC.
trend_summarytext
One sentence saying what the history shows, ready to paste into a ticket or a message.
Example output
{
  "change": 0.31872,
  "change_percent": 31.872,
  "cve": "CVE-2026-73570",
  "day_count": 31,
  "direction": "up",
  "earliest": {
    "cve": "CVE-2026-73570",
    "date": "2026-08-05",
    "epss": 0.04412,
    "epss_percent": 4.412,
    "likelihood": "medium",
    "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73570",
    "percentile": 0.91133,
    "percentile_rank": 91.133,
    "summary": "CVE-2026-73570 has a 4.41% chance of exploitation in the next 30 days, which puts it at the 91.1% percentile of all scored CVEs."
  },
  "highest": {
    "cve": "CVE-2026-73570",
    "date": "2026-09-03",
    "epss": 0.36284,
    "epss_percent": 36.284,
    "likelihood": "high",
    "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73570",
    "percentile": 0.97401,
    "percentile_rank": 97.401,
    "summary": "CVE-2026-73570 has a 36.3% chance of exploitation in the next 30 days, which puts it at the 97.4% percentile of all scored CVEs."
  },
  "history": [
    {
      "cve": "CVE-2026-73570",
      "date": "2026-08-05",
      "epss": 0.04412,
      "epss_percent": 4.412,
      "likelihood": "medium",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73570",
      "percentile": 0.91133,
      "percentile_rank": 91.133,
      "summary": "CVE-2026-73570 has a 4.41% chance of exploitation in the next 30 days, which puts it at the 91.1% percentile of all scored CVEs."
    },
    {
      "cve": "CVE-2026-73570",
      "date": "2026-09-03",
      "epss": 0.36284,
      "epss_percent": 36.284,
      "likelihood": "high",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73570",
      "percentile": 0.97401,
      "percentile_rank": 97.401,
      "summary": "CVE-2026-73570 has a 36.3% chance of exploitation in the next 30 days, which puts it at the 97.4% percentile of all scored CVEs."
    }
  ],
  "latest": {
    "cve": "CVE-2026-73570",
    "date": "2026-09-03",
    "epss": 0.36284,
    "epss_percent": 36.284,
    "likelihood": "high",
    "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73570",
    "percentile": 0.97401,
    "percentile_rank": 97.401,
    "summary": "CVE-2026-73570 has a 36.3% chance of exploitation in the next 30 days, which puts it at the 97.4% percentile of all scored CVEs."
  },
  "lowest": {
    "cve": "CVE-2026-73570",
    "date": "2026-08-05",
    "epss": 0.04412,
    "epss_percent": 4.412,
    "likelihood": "medium",
    "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73570",
    "percentile": 0.91133,
    "percentile_rank": 91.133,
    "summary": "CVE-2026-73570 has a 4.41% chance of exploitation in the next 30 days, which puts it at the 91.1% percentile of all scored CVEs."
  },
  "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73570",
  "retrieved_at": "2026-09-03T19:05:57Z",
  "trend_summary": "CVE-2026-73570 has risen from 4.41% on 2026-08-05 to 36.3% on 2026-09-03."
}

Get scoring details

Read which day's scores are current, how many CVEs FIRST has scored, and how they are spread across the four likelihood bands. Run it to confirm the connection works, or as the opening line of a report: 'of 367,633 scored CVEs, 533 are at 50% or more today'. No API key required.

Inputs

None.

Outputs

api_urltext
The endpoint this data was read from.
epss_urltext
FIRST's page for EPSS.
first_score_datetext
The first day FIRST published EPSS scores, and so the earliest day any step here can ask for.
high_countnumber
How many are between 10% and 50%.
low_countnumber
How many are below 1%.
medium_countnumber
How many are between 1% and 10%.
model_urltext
FIRST's explanation of how the score is produced, for a reader who wants the method.
retrieved_attext
When this step read the API, in UTC.
score_datetext
The day these scores were published, as YYYY-MM-DD. FIRST rescores every CVE daily, so an answer is only reproducible alongside its day.
scored_cve_countnumber
How many CVEs carry a score that day.
very_high_countnumber
How many are at 50% or more.
Example output
{
  "api_url": "https://api.first.org/data/v1/epss",
  "epss_url": "https://www.first.org/epss/",
  "first_score_date": "2021-04-14",
  "high_count": 16823,
  "low_count": 261825,
  "medium_count": 88452,
  "model_url": "https://www.first.org/epss/model",
  "retrieved_at": "2026-09-03T19:05:57Z",
  "score_date": "2026-09-03",
  "scored_cve_count": 367633,
  "very_high_count": 533
}

List recently scored CVEs

List the CVEs FIRST has newly scored or rescored in the last few days, so a scheduled workflow can report what changed since it last ran. Narrow it to a minimum probability to be told only about the ones that matter. No API key required.

Inputs

Days to look backdaysnumber
How far back to look. 7 covers a weekly report; 1 covers a daily one.From 1 to 120. Default: 7.
Minimum probability (%)minimum_probabilitynumber
Only CVEs with at least this chance of being exploited in the next 30 days, as a percentage. 10 keeps roughly the top 5% of all scored CVEs. Leave it empty for every probability.From 0 to 100.
Order bysorttext
How to order the results. Most likely to be exploited first by default.One of: probability_desc (Most likely to be exploited first), probability_asc (Least likely to be exploited first), cve_desc (Newest CVE ID first), cve_asc (Oldest CVE ID first). Default: probability_desc.
Maximum resultslimitnumber
How many CVEs to return. The answer also carries the total number that matched, so a capped list never reads as a complete one.From 1 to 500. Default: 25.
Skipoffsetnumber
How many matching CVEs to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 10000. Default: 0.

Outputs

countnumber
How many CVEs this step returned.
daysnumber
How many days back the step looked.
offsetnumber
How many matches were skipped before this page.
retrieved_attext
When this step read the API, in UTC.
score_datetext
The day these scores were published, as YYYY-MM-DD. FIRST rescores every CVE daily, so an answer is only reproducible alongside its day.
scoreslist
The matching CVEs, in the order asked for.
sincetext
The first day of that window, as YYYY-MM-DD.
sorttext
The order the CVEs came back in.
total_countnumber
How many CVEs matched in all, before the limit was applied.
truncatedtrue/false
True when matches were left out by the limit.
Example output
{
  "count": 2,
  "days": 7,
  "offset": 0,
  "retrieved_at": "2026-09-03T19:05:57Z",
  "score_date": "2026-09-03",
  "scores": [
    {
      "cve": "CVE-2021-44228",
      "date": "2026-09-03",
      "epss": 0.99999,
      "epss_percent": 99.999,
      "likelihood": "very_high",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "percentile": 1.0,
      "percentile_rank": 100.0,
      "summary": "CVE-2021-44228 has a 100% chance of exploitation in the next 30 days, which puts it at the 100% percentile of all scored CVEs."
    },
    {
      "cve": "CVE-2026-9854",
      "date": "2026-09-03",
      "epss": 0.00122,
      "epss_percent": 0.122,
      "likelihood": "low",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9854",
      "percentile": 0.02245,
      "percentile_rank": 2.245,
      "summary": "CVE-2026-9854 has a 0.122% chance of exploitation in the next 30 days, which puts it at the 2.24% percentile of all scored CVEs."
    }
  ],
  "since": "2026-08-27",
  "sort": "probability_desc",
  "total_count": 1119,
  "truncated": true
}

List the highest-risk CVEs

List the CVEs most likely to be exploited right now, across everything FIRST scores, highest first. Run it with nothing filled in for today's top 25 at 10% or better. Use it for a weekly threat briefing, or to see whether anything in your estate has arrived at the top of the list. No API key required.

Inputs

Minimum probability (%)minimum_probabilitynumber
The chance of exploitation, as a percentage, a CVE must reach to be listed. Defaults to 10, which is roughly the riskiest 5% of everything scored. Lower it to widen the list.From 0 to 100. Default: 10.
Minimum percentileminimum_percentilenumber
Only CVEs ranked at or above this percentile of everything FIRST scores, from 0 to 100. 99 means the riskiest one percent. Use this when you want a fixed share of the catalog rather than a fixed probability. Leave it empty for every rank.From 0 to 100.
Scores as ofas_ofdate
Read the scores FIRST published on this day rather than the newest ones. FIRST has published every day since 2021-04-14. Leave it empty for today's scores.
Maximum resultslimitnumber
How many CVEs to return, riskiest first. The answer also carries how many cleared the bar in all.From 1 to 500. Default: 25.
Skipoffsetnumber
How many matching CVEs to skip before returning any, for reading a long list a page at a time. Leave it at 0 for the first page.From 0 to 10000. Default: 0.

Outputs

countnumber
How many CVEs this step returned.
minimum_probabilitynumber
The threshold that was applied, as a percentage.
offsetnumber
How many matches were skipped before this page.
retrieved_attext
When this step read the API, in UTC.
score_datetext
The day these scores were published, as YYYY-MM-DD. FIRST rescores every CVE daily, so an answer is only reproducible alongside its day.
scoreslist
The matching CVEs, in the order asked for.
sorttext
The order the CVEs came back in.
total_countnumber
How many CVEs matched in all, before the limit was applied.
truncatedtrue/false
True when matches were left out by the limit.
Example output
{
  "count": 2,
  "minimum_probability": 10.0,
  "offset": 0,
  "retrieved_at": "2026-09-03T19:05:57Z",
  "score_date": "2026-09-03",
  "scores": [
    {
      "cve": "CVE-2021-44228",
      "date": "2026-09-03",
      "epss": 0.99999,
      "epss_percent": 99.999,
      "likelihood": "very_high",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "percentile": 1.0,
      "percentile_rank": 100.0,
      "summary": "CVE-2021-44228 has a 100% chance of exploitation in the next 30 days, which puts it at the 100% percentile of all scored CVEs."
    },
    {
      "cve": "CVE-2026-9854",
      "date": "2026-09-03",
      "epss": 0.00122,
      "epss_percent": 0.122,
      "likelihood": "low",
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9854",
      "percentile": 0.02245,
      "percentile_rank": 2.245,
      "summary": "CVE-2026-9854 has a 0.122% chance of exploitation in the next 30 days, which puts it at the 2.24% percentile of all scored CVEs."
    }
  ],
  "sort": "probability_desc",
  "total_count": 17356,
  "truncated": true
}

Score and rank a list of CVEs

Take a list of CVE IDs - a scanner export, a ticket queue, a vendor advisory - and get them back ordered by how likely each one is to be exploited in the next 30 days. The top of the list is the work to do first. Set a minimum probability and every result also says whether it clears the bar, with a flag a workflow can branch on. CVEs FIRST has not scored yet are listed separately rather than being mistaken for safe ones. No API key required.

Inputs

CVE IDscve_idslistRequired
The CVEs to score, up to 500. Any casing is accepted, and a value that is not a CVE ID is reported rather than failing the step.
Act-on threshold (%)minimum_probabilitynumber
The chance of exploitation, as a percentage, at which a CVE is worth acting on. 10 is a common cut. Every result says whether it clears this bar, and the answer carries a single flag for branching on. Leave it empty to rank without judging.From 0 to 100.

Outputs

above_threshold_countnumber
How many CVEs clear that threshold.
any_above_thresholdtrue/false
True when at least one CVE clears it, for branching a workflow on.
checked_countnumber
How many valid CVE IDs were looked up.
high_countnumber
How many are between 10% and 50%.
highest_cvetext
The CVE most likely to be exploited.
highest_epss_percentnumber
That CVE's probability, as a percentage.
invalidlist
The values that are not CVE IDs at all.
low_countnumber
How many are below 1%.
medium_countnumber
How many are between 1% and 10%.
minimum_probabilitynumber
The threshold this step was given, as a percentage, or empty when none was set.
retrieved_attext
When this step read the API, in UTC.
score_datetext
The day these scores were published, as YYYY-MM-DD. FIRST rescores every CVE daily, so an answer is only reproducible alongside its day.
scored_countnumber
How many of the CVEs have a score.
scoreslist
Every CVE that has a score, most likely to be exploited first. The top of this list is the work to do first.
unscoredlist
The CVEs FIRST has no score for. Usually ones published too recently to have been scored yet, or withdrawn - not safe ones.
unscored_countnumber
How many do not.
very_high_countnumber
How many are at 50% or more.
Example output
{
  "above_threshold_count": 1,
  "any_above_threshold": true,
  "checked_count": 3,
  "high_count": 0,
  "highest_cve": "CVE-2021-44228",
  "highest_epss_percent": 99.999,
  "invalid": [
    "not-a-cve"
  ],
  "low_count": 1,
  "medium_count": 0,
  "minimum_probability": 10.0,
  "retrieved_at": "2026-09-03T19:05:57Z",
  "score_date": "2026-09-03",
  "scored_count": 2,
  "scores": [
    {
      "cve": "CVE-2021-44228",
      "date": "2026-09-03",
      "epss": 0.99999,
      "epss_percent": 99.999,
      "likelihood": "very_high",
      "meets_threshold": true,
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228",
      "percentile": 1.0,
      "percentile_rank": 100.0,
      "summary": "CVE-2021-44228 has a 100% chance of exploitation in the next 30 days, which puts it at the 100% percentile of all scored CVEs."
    },
    {
      "cve": "CVE-2026-9854",
      "date": "2026-09-03",
      "epss": 0.00122,
      "epss_percent": 0.122,
      "likelihood": "low",
      "meets_threshold": false,
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9854",
      "percentile": 0.02245,
      "percentile_rank": 2.245,
      "summary": "CVE-2026-9854 has a 0.122% chance of exploitation in the next 30 days, which puts it at the 2.24% percentile of all scored CVEs."
    }
  ],
  "unscored": [
    "CVE-2026-99999"
  ],
  "unscored_count": 1,
  "very_high_count": 1
}

Entur

Previous Page

ERPNext

Next Page

On this page

ActionsBrowse EPSS scoresExport scores as CSVGet a CVE's exploit probabilityGet a CVE's score historyGet scoring detailsList recently scored CVEsList the highest-risk CVEsScore and rank a list of CVEs