FIRST Exploit Prediction Scoring System (EPSS)

A daily probability, from 0 to 1, that a CVE will see exploitation activity in the next 30 days, with its percentile rank among all scored CVEs.

FIRST.org EPSS Special Interest Group.

• first.org/epss
• EPSS API
• Daily CSV

Scores are published free of charge by CSV download and API, with no registration. FIRST asks for attribution when EPSS data is used in publications or products, and we give it on every response.

EPSS usage agreement

Daily. A new score is published every day for every scored CVE. We load the daily CSV, which is the right way to keep a local copy; the API is designed for lookups.

CVE ID, EPSS score, percentile, score date, model version. EPSS v5 has been in use since 15 June 2026.

• Only CVEs with published IDs are scored.
• Scores move every day, so we return the score date with every value.

The stackbyte.epss.* fields in CVE Triage, and one of the inputs to the triage priority.

Field by field details are in the CVE Triage docs.