EPSS Exploit Prediction Scraper
Pricing
from $24.00 / 1,000 results
EPSS Exploit Prediction Scraper
Scrapes EPSS exploit prediction scores from the FIRST public data service. Returns CVE ID, EPSS score, percentile, and date for single CVEs, lists, or the full daily corpus with optional history and flattened output.
Pricing
from $24.00 / 1,000 results
Rating
0.0
(0)
Developer
ParseForge
Maintained by CommunityActor stats
0
Bookmarked
2
Total users
0
Monthly active users
12 days ago
Last modified
Categories
Share
EPSS Exploit Prediction Scraper
Scrape EPSS exploit prediction scores for any CVE or the entire daily corpus, up to a million records per run. Every record includes the EPSS score, percentile, and date. Filter by probability threshold, track score history, or flatten time series for direct SQL import.
The Exploit Prediction Scoring System (EPSS) from FIRST gives a daily probability that a vulnerability will be exploited in the wild. This Actor reads the public EPSS data service directly, so you can pull scores for a single CVE, a list of CVEs, or the complete daily dataset without writing API glue. Filter by minimum score or percentile, pull up to two years of score history, and export the structured results to CSV, JSON, Excel, or XML.
| Who uses it | What they scrape FIRST EPSS for |
|---|---|
| Vulnerability management teams | Prioritize which CVEs to patch this week based on real-world exploit probability. |
| SOC analysts | Enrich alerts with the EPSS score to decide which incidents to escalate first. |
| Threat intelligence platforms | Ingest the daily EPSS feed to keep risk dashboards current. |
| GRC and audit teams | Pull historical EPSS scores to demonstrate risk-based patch compliance over time. |
What it does
This Actor collects EPSS exploit prediction scores from the FIRST public data service and returns each CVE record with its score, percentile, and date.
- 🎯 Targeted CVE lookup: Pass a single CVE ID or a comma-separated list to get only the scores you need.
- 📅 Historical time series: Set a history window up to 730 days to track how a CVE's exploit probability evolved.
- 📊 Score and percentile filtering: Keep only CVEs above a minimum EPSS score or in the top percentile to cut noise.
- 🗓️ Date-specific snapshots: Fetch the EPSS scores published on a particular date for audit or comparison.
- 📄 Flattened output: When pulling history, output one row per CVE per date instead of nested arrays, ready for spreadsheets and SQL.
Results export to CSV, JSON, Excel, or XML, or straight from the API.
What you can do with FIRST EPSS data
📈 Prioritize the patch backlog.
A vulnerability manager pulls the full daily EPSS feed filtered to scores above 0.1 and sorts by percentile to decide which 50 CVEs the team patches this sprint.
🚨 Enrich SIEM alerts with exploit probability.
A SOC analyst runs the Actor for a list of CVEs from the morning's high-severity alerts and attaches the EPSS score to each ticket before triage.
📋 Demonstrate risk-based compliance.
A GRC analyst pulls 12 months of EPSS history for every CVE in the environment and exports the flattened CSV to show auditors that patches tracked exploit likelihood.
🔬 Research exploit trends.
A threat researcher scrapes the full daily corpus for the past 90 days and plots the median EPSS percentile over time to spot shifts in attacker behavior.
Why choose this scraper
| What you get | |
|---|---|
| No API key required | Reads the public FIRST EPSS data service with no registration or authentication. |
| Full daily corpus | Pull every CVE with an EPSS score for a given date in a single run. |
| Score history | Retrieve up to two years of daily scores per CVE to analyze trends. |
| Flat or nested output | Choose a flat row-per-date format for SQL or a nested time-series array per CVE. |
| Fixed schema | Every record returns the same fields: CVE ID, EPSS score, percentile, and date. |
How it compares
This Actor focuses on the FIRST EPSS data service with history windows and flattened output, while the competitors below bundle EPSS with other intelligence sources or offer a lighter lookup.
| Feature | ParseForge | Cyber Vulnerability Intelligence | Cisa-Kev-Enricher | FIRST EPSS Scores Scraper |
|---|---|---|---|---|
| Full daily EPSS corpus | Yes | Not listed | Not listed | Not listed |
| Score history up to 730 days | Yes | Not listed | Not listed | Not listed |
| Flattened time-series output | Yes | Not listed | Not listed | Not listed |
| Filter by minimum EPSS score | Yes | Not listed | Not listed | Not listed |
| Filter by minimum percentile | Yes | Not listed | Not listed | Not listed |
| CISA KEV catalog integration | Not listed | Yes | Yes | Not listed |
| Ransomware campaign context | Not listed | Not listed | Yes | Not listed |
Configure the run
Drive the Actor with a CVE ID, a comma-separated list, or leave the CVE field empty to scrape the full daily corpus. Filters on minimum EPSS score and percentile run as each record is read so only matches reach your dataset. The Input tab lists every parameter.
A first run with the defaults:
A larger pull:
Pricing
Pay-per-result: $0.032 per result collected. You pay only for the results written to your dataset.
| Results collected | Approximate cost |
|---|---|
| 100 results | $3.20 |
| 1,000 results | $32.00 |
| 10,000 results | $320.00 |
New Apify accounts start with $5 in free credit.
Free users
Free-plan runs return up to 10 results as a preview. Upgrade your Apify plan to collect up to 1,000,000 results per run.
Run it
- Create a free Apify account with $5 in credit.
- Open the EPSS Exploit Prediction Scraper.
- Set your inputs and any filters, then click Start.
- Export the results as CSV, Excel, JSON, or XML from the Dataset tab.
Run it programmatically through the Apify API (run-sync-get-dataset-items) or the ApifyClient for JavaScript and Python.
Use with AI agents (MCP)
Give an AI agent live access to FIRST EPSS through the Model Context Protocol. Add the Actor to Claude, Cursor, or any MCP client:
Then prompt it in plain language to run the scraper and read back the results.
Troubleshooting
Why am I getting no results for my CVE ID?
Check that the CVE ID is formatted correctly (e.g. 'CVE-2021-44228'). If the CVE is very new or very old, it may not yet have an EPSS score. Try leaving the CVE field empty and filtering by date to confirm the service is reachable.
The Actor returns fewer records than I expected.
Check your 'Minimum EPSS Score' and 'Minimum Percentile' filters. If either is set, CVEs below the threshold are excluded. Also verify the 'Maximum records' limit is high enough for your query.
My history window returns only one row per CVE.
EPSS scores are published daily, but a CVE may not have a score for every single day in your window. If you need one row per day regardless, enable 'Flatten Time Series' and the Actor will fill the dates it has data for.
The run fails with a timeout.
Pulling the full daily corpus with a large history window can take time. Increase the run timeout in your Actor task settings, or reduce the 'History Window' and 'Maximum records' values to narrow the request.
I need the data in a specific format for my SIEM.
The Actor exports to CSV, JSON, Excel, and XML. Choose the format that matches your SIEM's ingestion requirements. For most SIEMs, the flattened CSV output with one row per CVE per date works best.
FAQ
| Question | Answer |
|---|---|
| What is EPSS? | The Exploit Prediction Scoring System is a daily-updated, data-driven estimate of the probability that a software vulnerability will be exploited in the wild within the next 30 days. It is produced by FIRST and scores range from 0 to 1. |
| Do I need an API key to scrape EPSS scores? | No. This Actor reads the public FIRST EPSS data service directly. No registration, API key, or authentication is required. |
| How do I get scores for a single CVE? | Enter the CVE ID in the 'CVE ID(s)' field, for example 'CVE-2021-44228'. The Actor will return the latest EPSS score and percentile for that vulnerability. |
| Can I pull the entire EPSS dataset for a day? | Yes. Leave the 'CVE ID(s)' field empty and the Actor will scrape every CVE that has an EPSS score for the requested date. |
| How do I track how a CVE's score changed over time? | Set the 'History Window (days)' input to the number of days you want to look back, up to 730. The Actor will return one score per day for that CVE. |
| What does the percentile mean? | The EPSS percentile tells you how a CVE's exploit probability ranks relative to all other scored CVEs. A percentile of 0.95 means the CVE has a higher EPSS score than 95% of all CVEs. |
| How do I filter out low-probability CVEs? | Use the 'Minimum EPSS Score' field to keep only CVEs above a threshold, or 'Minimum Percentile' to keep only the top-ranked CVEs. Both filters accept values between 0.0 and 1.0. |
| What is the flattened output option? | When you pull a history window, the default output nests the time series inside each CVE record. Enabling 'Flatten Time Series' outputs one row per CVE per date instead, which is easier to load into a spreadsheet or SQL database. |
| Can I get EPSS scores for a specific past date? | Yes. Set the 'Score Date' field to a date in YYYY-MM-DD format. The Actor will return the EPSS scores published on that day. |
| How many records can I scrape in one run? | You can set the 'Maximum records' field up to 1,000,000. The full daily EPSS corpus contains over 200,000 CVEs, so a single run can capture the entire dataset. |
Related actors
Browse the full ParseForge collection for more scrapers.
🆘 Need help? Email parseforge@protonmail.com with your run ID, your input, and what you expected.
⚠️ Disclaimer. This Actor is unofficial and is not affiliated with, endorsed by, or sponsored by Forum of Incident Response and Security Teams, Inc. It collects only publicly available data. You are responsible for using the collected data in compliance with the source's terms of service and applicable data-protection laws, including GDPR, CCPA, and PIPL. Do not use it to collect personal data unlawfully.
