---
title: "Prioritize vulnerabilities by likelihood of exploitation with EPSS scores"
description: "Vulnerability records now show how likely each vulnerability is to be exploited, so you can order a backlog of High and Critical findings by what’s likely to be attacked, not just by severity."
canonical_url: "https://cloudsmith.com/changelog/prioritize-vulnerabilities-by-likelihood-of-exploitation-with-epss-scores"
last_updated: "2026-11-05T11:25:08.276Z"
---
# Prioritize vulnerabilities by likelihood of exploitation with EPSS scores

Vulnerability records now show how likely each vulnerability is to be exploited, so you can order a backlog of High and Critical findings by what’s likely to be attacked, not just by severity.

The scores come from the Exploit Prediction Scoring System (EPSS), maintained by the Forum of Incident Response and Security Teams ([FIRST](https://www.first.org/epss/)). EPSS estimates the probability of exploitation in the next 30 days. EPSS data was already available in Cloudsmith’s policies. It now also appears as a score and percentile in vulnerability records on the package **Compliance **tab of the Cloudsmith web app, and in the `epss` response field of the [Packages Vulnerabilities List](https://docs.cloudsmith.com/api/packages/vulnerabilities/list) endpoint.



```json
{
  "_key": "a32bf76cfadf",
  "_type": "image",
  "alt": "The Compliance tab view for a package in the Cloudsmith web app.",
  "asset": {
    "_createdAt": "2026-11-05T11:10:46Z",
    "_id": "image-9433fa10f2090b23f9f7cb722030027709ee4ff2-2830x1166-png",
    "_rev": "KicryJuvBOo733dKGhb4Xo",
    "_type": "sanity.imageAsset",
    "_updatedAt": "2026-11-05T11:10:46Z",
    "assetId": "9433fa10f2090b23f9f7cb722030027709ee4ff2",
    "extension": "png",
    "metadata": {
      "_type": "sanity.imageMetadata",
      "blurHash": "MCSija%2adxt%2_NM|S4t8M|RjslocRjof",
      "dimensions": {
        "_type": "sanity.imageDimensions",
        "aspectRatio": 2.4271012006861064,
        "height": 1166,
        "width": 2830
      },
      "hasAlpha": true,
      "isOpaque": true,
      "lqip": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABQAAAAICAYAAAD5nd/tAAAACXBIWXMAAAPoAAAD6AG1e1JrAAABQUlEQVQokYWQy47VMBBE8/9/xpLFsAGJYcUwcF9xbPfLPqidO2xJVErclk5X1bZX4ehGFaOpU8V5VGVvRreBBf9Vj0FRo6iziQXdfEk9yHNCE24x8fFU/sckPs5jEhPGhJgTG2PNtohBk9Nh1wQOujpdFTXHPPAIzAI1wz2IMRZ4zgmcyjefLS8S9hHz6E4XpYnQutLVlvMEJ9DcFzBhI115LvW1NGfbmBNRpzSlVKV2Q9QQ8zXPCmQBBx7jn7tMlovv+8HtsVNqW+BtjEB65aiF2mR1pyve2We6Ox0O9Kms6Po4+HW58X658fv64FEqYsY2XbDjDSk/6VLpdrpbvfaMrmd0OedZweW+8/LtlZev33m/3jlaX/OMvU1vePmB7a+olHWRm1oXjtpWlPzmOecZ8+3PlU+fvywlUJ+9Zn1/AXYwcJVPripjAAAAAElFTkSuQmCC",
      "palette": {
        "_type": "sanity.imagePalette",
        "darkMuted": {
          "_type": "sanity.imagePaletteSwatch",
          "background": "#2f4453",
          "foreground": "#fff",
          "population": 0.31,
          "title": "#fff"
        },
        "darkVibrant": {
          "_type": "sanity.imagePaletteSwatch",
          "background": "#0e293e",
          "foreground": "#fff",
          "population": 0.06,
          "title": "#fff"
        },
        "dominant": {
          "_type": "sanity.imagePaletteSwatch",
          "background": "#2f4453",
          "foreground": "#fff",
          "population": 0.31,
          "title": "#fff"
        },
        "lightMuted": {
          "_type": "sanity.imagePaletteSwatch",
          "background": "#9cd0bd",
          "foreground": "#000",
          "population": 0.02,
          "title": "#fff"
        },
        "lightVibrant": {
          "_type": "sanity.imagePaletteSwatch",
          "background": "#fccc62",
          "foreground": "#000",
          "population": 0.02,
          "title": "#000"
        },
        "muted": {
          "_type": "sanity.imagePaletteSwatch",
          "background": "#687c88",
          "foreground": "#fff",
          "population": 0.02,
          "title": "#fff"
        },
        "vibrant": {
          "_type": "sanity.imagePaletteSwatch",
          "background": "#e2a41c",
          "foreground": "#000",
          "population": 0.03,
          "title": "#fff"
        }
      },
      "thumbHash": "/fcBA4Bo1aRPtzOJ3AH5G1A="
    },
    "mimeType": "image/png",
    "originalFilename": "packageComplianceTab.png",
    "path": "images/rafvlnhi/production/9433fa10f2090b23f9f7cb722030027709ee4ff2-2830x1166.png",
    "sha1hash": "9433fa10f2090b23f9f7cb722030027709ee4ff2",
    "size": 351845,
    "uploadId": "56a80bcc7076b6ce1f5d47af573e41642a9423ae",
    "url": "https://cdn.sanity.io/images/rafvlnhi/production/9433fa10f2090b23f9f7cb722030027709ee4ff2-2830x1166.png"
  },
  "link": {
    "_type": "link",
    "href": null,
    "openInNewTab": false
  },
  "markDefs": null
}
```

EPSS data is available on Ultra and Enterprise plans.

For more details, see [Vulnerability detection](https://docs.cloudsmith.com/supply-chain-security/risk-detection/vulnerability-detection) in the Cloudsmith documentation.