EPSS (FIRST.org) API

Free EPSS API from FIRST.org with no key: daily exploitation probability and percentile for every published CVE. Prioritise patching by likelihood, not just severity.

No API key requiredCORS enabledHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-21

What is the EPSS (FIRST.org) API?

The EPSS API is a free, key-free service from FIRST.org returning Exploit Prediction Scoring System values. For any CVE it gives a probability between 0 and 1 that the vulnerability will be exploited in the wild within the next 30 days, plus its percentile rank against all scored CVEs.

EPSS answers a question CVSS does not: not how bad a vulnerability would be if exploited, but how likely anyone is to exploit it. Those are very different, and conflating them is why so many patching programmes drown. The model is trained on observed exploitation activity and refreshed daily, so a CVE's score moves as proof-of-concept code appears, as scanners start probing for it, and as attention fades again.

Read the two numbers as a pair. The example returns 0.99999 for Log4Shell with a percentile of 1.0 — near-certain exploitation, at the very top of the distribution. The absolute probability tells you the risk; the percentile tells you where it sits relative to everything else, which is what actually drives prioritisation when you have a thousand findings. Most CVEs score below 0.01, so an apparently small probability can still be a high percentile. EPSS is explicitly a prediction, not an observation: it is not a statement that a vulnerability has been exploited, which is what CISA's KEV catalogue records instead. The two are complementary and FIRST recommends using them together.

Quick facts

Base URL: https://api.first.org/data/v1/epss
Authentication: No API key or account. FIRST.org publishes EPSS free for any use including commercial, asking for attribution to the EPSS project.
Rate limit: No published hard limit. Scores change once daily, so caching for a day costs nothing in accuracy and removes almost all traffic.
Pricing: Free, including commercial use, with attribution requested.
CORS: Enabled — callable directly from browser JavaScript
Official docs: Read the docs

How to use the EPSS (FIRST.org) API

Every request below was executed against the live API on 2026-08-21, and the response shown is the real body it returned — not an illustration.

1. Fetch the exploitation probability for Log4Shell

GET https://api.first.org/data/v1/epss?cve=CVE-2021-44228

curl

curl 'https://api.first.org/data/v1/epss?cve=CVE-2021-44228'

JavaScript (fetch)

const res = await fetch("https://api.first.org/data/v1/epss?cve=CVE-2021-44228");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://api.first.org/data/v1/epss?cve=CVE-2021-44228", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200

{
  "status": "OK",
  "status-code": 200,
  "version": "1.0",
  "access": "public",
  "total": 1,
  "offset": 0,
  "limit": 100,
  "data": [
    {
      "cve": "CVE-2021-44228",
      "epss": "0.999990000",
      "percentile": "1.000000000",
      "date": "2026-08-20"
    }
  ]
}

Parameters

Parameter	Type	Required	Description
`cve`	query	Optional	One CVE ID, or several comma-separated in a single request. `CVE-2021-44228`
`date`	query	Optional	Historical scores for a specific date, which is how you chart a CVE's trajectory. `2026-01-15`
`days`	query	Optional	Return only CVEs whose score changed within the last N days. `7`
`epss-gt`	query	Optional	Filter to CVEs with a probability greater than this value. `0.5`
`percentile-gt`	query	Optional	Filter by percentile rather than absolute probability. `0.95`
`offset / limit`	query	Optional	Paging. Default limit is 100, maximum 10000 per request. `100`
`scope`	query	Optional	Set to `time-series` for a CVE's full score history in one response. `time-series`

Response fields

status / status-codestring / integer: FIRST's envelope. Always check these rather than only the HTTP status.
totalinteger: Number of matching records, independent of paging.
data[].cvestring: The CVE identifier.
data[].epssstring: Probability of exploitation in the next 30 days, 0 to 1, as a string. Cast before comparing.
data[].percentilestring: Rank against all scored CVEs, 0 to 1. The number to sort on when prioritising.
data[].datestring: The model run date these values come from. Scores are recomputed daily.

What you can build with the EPSS (FIRST.org) API

Prioritise a vulnerability backlog by exploitation likelihood rather than CVSS alone
Alert when a CVE in your estate crosses an EPSS threshold
Chart a vulnerability's exploitation probability over time
Combine EPSS with CISA KEV to separate predicted from confirmed exploitation
Report patching coverage weighted by real-world risk

Common errors and how to fix them

Empty data array

The CVE has no EPSS score.

Fix: Very new CVEs are unscored until the next daily model run, and rejected or reserved IDs are never scored. Absence is not a score of zero.

Values are strings

`epss` and `percentile` are serialised as strings.

Fix: Cast to float before comparing. String comparison will sort `0.9` above `0.11` correctly by luck and fail elsewhere.

Only 100 results returned

Default paging.

Fix: Set `limit` up to 10000 and page with `offset`, reading `total` to know when to stop.

Score differs from yesterday

The model re-runs daily.

Fix: That is intended behaviour. Store the `date` alongside any score you persist so you can explain a change.

EPSS (FIRST.org) API — frequently asked questions

Is the EPSS API free?

Yes, free with no key or registration, and free for commercial use with attribution to the EPSS project at FIRST.org.

What is the difference between EPSS and CVSS?

CVSS measures how severe a vulnerability would be if exploited. EPSS estimates how likely it is to be exploited in the next 30 days. A high CVSS with a low EPSS is a serious flaw nobody is attacking; a moderate CVSS with a high EPSS may deserve your attention first.

Does a high EPSS score mean a vulnerability has been exploited?

No. EPSS is a prediction, not an observation. For confirmed exploitation in the wild, use CISA's Known Exploited Vulnerabilities catalogue, which records vulnerabilities with evidence of active attack. FIRST recommends using the two together.

How often do EPSS scores change?

Daily. The model re-scores every published CVE each day, so scores move as exploitation activity changes. Cache for a day and record the `date` with any score you store.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

JSON to CSV Converter

Convert a JSON array of objects to CSV online. Automatic column headers from the union of all keys, delimiter choice and proper quoting — all in-browser.

CSV Column Statistics Calculator

Profile a CSV column by column: type, blanks, distinct values, min, max, mean, median, standard deviation and percentiles, plus top values — all in-browser.

EPSS (FIRST.org) is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-21; always check the official documentation before relying on this API in production, as terms and limits can change.