Free tool
EPSS score lookup
Type or paste CVE identifiers to get today’s EPSS score: the probability, estimated by FIRST, that each vulnerability is exploited in the wild in the next 30 days.
Runs entirely in your browser: nothing you type or open is sent to us or stored.
| CVE | EPSS (30 days) | Percentile | Reading |
|---|
EPSS, KEV and the CRA reporting clock
The Exploit Prediction Scoring System (EPSS), maintained by FIRST, estimates every day the probability that a published vulnerability will be exploited in the wild within 30 days. The percentile places it among all the others: 0.95 means it is more likely to be exploited than 95% of them.
EPSS is a prediction, not a fact. The CRA reporting clock starts when you become aware that a vulnerability in your product is actively exploited, which the catalogues of exploited vulnerabilities (CISA KEV, the EU Vulnerability Database) record. Use EPSS to decide what to fix first among the vulnerabilities that are not exploited yet; Provetry shows the EPSS score next to every vulnerability of your products.
Other free tools
- security.txt generator and checker
Write the RFC 9116 file that tells researchers where to report a vulnerability, or check the one you have.
- CVSS 3.1 calculator
Score a vulnerability from its eight base metrics, or paste a vector to read it.
- CVSS 4.0 calculator
The newer version of CVSS, scored with FIRST’s reference calculation: base metrics, or any vector pasted.
- Vulnerability disclosure policy generator
A coordinated vulnerability disclosure policy for your products, ready to publish, in English, French or German.
- SBOM generator
Turn your lock files into a CycloneDX or SPDX SBOM: npm, pnpm, Yarn, Python, Go, Rust, Java, .NET, PHP and Ruby.
- SBOM viewer and checker
Open a CycloneDX or SPDX file: its components, and what the CRA expects that is missing.