FIRST EPSS Scores API

Use in your agent

Load selected FIRST EPSS scores into pandas and Parquet. Checked against the provider's documentation on Nov 1, 2026.

Access

• No account, registration or key. Use the CVE query parameter for one CVE or a small comma-separated batch.

Request

curl 'https://api.first.org/data/v1/epss?cve=CVE-2021-44228,CVE-2023-44487,CVE-2024-3094'

Format

JSON response metadata and rows containing CVE ID, EPSS probability, percentile and score date.

Load into pandas and Parquet

Needs Python 3 with requests, pandas and pyarrow.

"""Selected FIRST EPSS scores -> pandas -> Parquet. No key."""
import requests
import pandas as pd

URL = "https://api.first.org/data/v1/epss"
CVES = "CVE-2021-44228,CVE-2023-44487,CVE-2024-3094"
r = requests.get(URL, params={"cve": CVES}, timeout=60)
r.raise_for_status()
df = pd.DataFrame(r.json()["data"])
df["epss"] = pd.to_numeric(df["epss"])
df["percentile"] = pd.to_numeric(df["percentile"])
df["date"] = pd.to_datetime(df["date"], utc=True)
df.to_parquet("first_epss.parquet", index=False)
print(len(df), "scores", df["date"].min().date().isoformat(),
      "maximum", f'{df["epss"].max():.6f}')

Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 3 scores 2026-11-01 maximum 0.999990

Limits

• Public endpoints are limited to 1,000 requests per minute.
• The CVE filter accepts at most 2,000 characters including commas; the global page limit is 10,000 records.
• FIRST says the API is for lookup, not bulk synchronization; use the daily CSV for the complete current population.

Quirks

• EPSS is a probability of observed exploitation activity in the next 30 days, not a severity score.
• percentile is relative to the currently scored population and can move even when a CVE's probability changes little.
• Historical score series cross several model versions, which can create discontinuities unrelated to a vulnerability-specific event.

Terms and attribution

• FIRST publishes EPSS scores free of charge with no registration required.
• The service-content licence is limited to vulnerability disclosure, cybersecurity incident response or preventative cybersecurity uses; attribution is requested for publications or products.

Sources

• https://www.first.org/epss/data: “EPSS scores are published daily, free of charge, with no registration required.”
• https://api.first.org/: “Public endpoints without authentication are limited to 1000 requests per minute.”
• https://api.first.org/epss: “The maximum size accepted for this parameter is 2000 characters (including commas).”
• https://www.first.org/epss/faq: “Attribution is requested when EPSS data is used in publications or products.”