EPSS had scores for 329,934 CVEs as of May 1, 2026.

High Business Priority is the most frequent risk-elevating factor at 27.76%, followed by PII Processing at 22.08% and CVSS High Severity at 20.55%.

25% of ICS-CERT and NVD vulnerabilities have incorrect CVSS scores.