EPSS Exploit Prediction Scores Scraper

Scrape EPSS (Exploit Prediction Scoring System) data from FIRST.org — the daily-updated probability that a given CVE will be exploited in the wild within the next 30 days. That is the prioritisation signal severity scores lack: CVSS tells you how bad a vulnerability would be if exploited, EPSS tells you how likely it is to actually be exploited. No API key, no login, no proxy required.

Covers 354,000+ CVEs, rescored every single day by FIRST.org's machine-learning model.

Why EPSS instead of just CVSS?

CVSS is a static severity rating — it describes the theoretical impact and exploitability characteristics of a flaw, and it barely changes over a CVE's lifetime. EPSS is a live, empirical probability derived from real-world exploitation telemetry, so it re-ranks your backlog every day and tells you which of your 4,000 "critical" CVSS 9.8s are the ~2% that attackers are actually weaponising right now.

Features

• 4 scrape modes — explicit CVE lookup, top-risk listing, full daily dump, and 30-day score history.
• No API key — FIRST.org's EPSS API is free and public.
• Never silently drops a CVE — a CVE the EPSS model does not know still returns a row with found: false and null scores, so your joins stay intact.
• Derived risk fields — risk_band, in_top_1pct, in_top_10pct, percentage-formatted scores.
• Trend detection in history mode — previous_epss, epss_change, and rising / falling / stable.
• Streaming bulk mode — the ~350k-row gzipped daily dump is decompressed incrementally, so memory stays flat.
• Numbers arrive from the API as strings ("0.97236") and are converted to real floats for you.

Modes

Mode	What it does	Uses
top (default)	Highest-risk CVEs above the minEpss probability threshold, sorted highest first	minEpss, maxItems
cves	Look up an explicit list of CVE ids	cves
bulk	Stream the full daily EPSS dump (354k+ CVEs)	maxItems
history	30-day EPSS time series per CVE, with trend	cves, days, maxItems

Input

Field	Type	Default	Description
mode	string	top	top, cves, bulk or history.
cves	array	[]	CVE ids for cves / history mode, e.g. CVE-2021-44228.
minEpss	number	0.5	Exploit-probability threshold for top mode. 0.5 = 50% chance of exploitation in 30 days.
days	integer	30	Days of score history per CVE in history mode (API window is 30).
maxItems	integer	500	Hard cap on dataset rows (max 50,000).

{
  "mode": "cves",
  "cves": ["CVE-2021-44228", "CVE-2014-0160"],
  "maxItems": 500
}

Output

One row per CVE per scoring date.

{
  "cve": "CVE-2021-44228",
  "epss": 0.99999,
  "epss_percent": 99.999,
  "percentile": 1.0,
  "percentile_pct": 100.0,
  "date": "2026-07-29",
  "risk_band": "critical",
  "in_top_1pct": true,
  "in_top_10pct": true,
  "found": true,
  "previous_epss": null,
  "epss_change": null,
  "trend": null,
  "url": "https://www.first.org/epss/",
  "source": "first-epss",
  "scraped_at": "2026-07-30T13:40:11Z"
}

Field	Description
cve	CVE identifier, upper-cased.
epss	Exploit probability, float 0–1.
epss_percent	epss * 100, rounded to 3 decimals.
percentile	Rank against all scored CVEs, float 0–1.
percentile_pct	percentile * 100, rounded to 2 decimals.
date	Scoring date (ISO YYYY-MM-DD).
risk_band	critical (≥0.5), high (≥0.1), medium (≥0.01), else low.
in_top_1pct / in_top_10pct	Percentile ≥ 0.99 / ≥ 0.90.
found	false for CVEs EPSS does not score.
previous_epss, epss_change, trend	History mode: prior day's score, delta, and rising / falling / stable.
url, source, scraped_at	Provenance.

All fields are nullable.

Use cases

• Vulnerability prioritisation — patch the 2% of CVEs that are actually being exploited instead of every CVSS 9.8.
• Risk scoring — blend EPSS probability with your own asset criticality for a true expected-loss ranking.
• SOC dashboards — feed daily bulk runs into Grafana/Splunk and alert when a CVE in your stack crosses risk_band: critical.
• Patch planning — use history mode to catch CVEs whose exploit probability is rising and pull the patch window forward.
• Compliance evidence — document why a low-EPSS "critical" was deferred.

Pricing

Roughly $0.5 per 1,000 results. A bulk run pulling all 354k CVEs takes a couple of minutes.

Related actors

• CIRCL CVE Scraper — full CVE records, CVSS vectors and references.
• GitHub Advisories Scraper — package-level advisories and affected version ranges.
• Exploit-DB Scraper — public exploit code and proof-of-concepts.
• NIST CPE Scraper — the CPE product dictionary for asset matching.

Pair this actor with CIRCL for the vulnerability detail and Exploit-DB for the weaponisation evidence — EPSS supplies the probability that ties them together.

Notes

• Data © FIRST.org, published under the EPSS terms of use. Scores update daily.
• The FIRST.org API caps limit at 10,000 records per request; the actor pages automatically.
• Bulk mode reads https://epss.cyentia.com/epss_scores-current.csv.gz (redirects to Empirical Security's CDN).

Development

$python tests/test_mapping.py   # offline smoke tests, stdlib only