EPSS Score Lookup

The EPSS score lookup returns the Exploit Prediction Scoring System score and percentile for one CVE or a list of up to 100. Paste CVE IDs in any form, such as scanner output or a ticket, and the tool picks them out. Each result shows the score date, the model version, and whether the CVE is in the CISA Known Exploited Vulnerabilities catalog. A single CVE also gets its scores for the last 30 days.

Sorting a scanner's list of CVEs by how likely exploitation activity is, checking whether a CVE in a ticket is in the CISA KEV catalog, and following how one CVE's score moved over the last month.

The EPSS Score Lookup sends the CVE IDs you enter to ImmunitySec servers, which run the check and return the result. To run it, they contact the FIRST EPSS API at api.first.org. Nothing else you enter leaves the page.

EPSS estimates the probability that a vulnerability will be exploited in the wild within the next 30 days, which helps decide which of many open vulnerabilities to fix first. FIRST states that EPSS is not a complete risk score: it does not measure how much damage exploitation would cause or whether a vulnerability affects your environment. The CISA KEV catalog records confirmed exploitation, and FIRST says KEV should take precedence when present.

No. FIRST states that EPSS is not a complete risk score: it does not measure how much damage successful exploitation would cause, or whether the vulnerability affects your environment. It provides the threat likelihood part of a risk calculation only.

FIRST sets no universal threshold. A threshold of 0.10 (10%) is commonly cited in the field but carries no special authority from EPSS, and EPSS does not define score bands such as critical or high. The right threshold depends on your remediation capacity, risk tolerance, and asset context.

FIRST publishes new scores every day, typically shortly after 13:30 UTC. A score that changes overnight means new signals arrived, such as exploit code becoming publicly available.

CVSS and EPSS measure different things. EPSS uses the individual CVSS metrics as input features, not the scores. FIRST warns that multiplying an EPSS probability by a CVSS score produces a number with no interpretable meaning.

KEV. FIRST's answer to this question is to follow KEV: a KEV listing is confirmed exploitation, while EPSS forecasts the next 30 days, so a low score on a KEV-listed vulnerability is not a contradiction.