FIRST EPSS / Exploit Prediction Score

The EPSS score for one CVE: the probability (0 to 1) that it is exploited in the wild in the next 30 days, and its percentile among all scored CVEs, as of the latest daily model run, direct from FIRST's API at api.first.org. Reply: { status, status-code, total, offset, limit, data: [{ cve, epss, percentile, date }] }; epss and percentile arrive as decimal strings. A CVE EPSS has not scored answers 200 with an empty data array. EPSS is FIRST's own model, so any other provider of this job is a mirror of the same number, not an independent opinion. Data credit (requested by FIRST's EPSS usage agreement): "See EPSS at https://www.first.org/epss".