Cross-Vendor Patch Advisories
Every vendor except Microsoft: CISA KEV advisories scored on the EVULNABLE Risk scale, Linux distribution advisories, and vendor security bulletins.
Browse Advisories
29 of 1,308 advisories match the current filters, sorted by EVULNABLE Risk.
| CVE | Vendor | Product | Vulnerability | EVRS | EPSS | Ransomware | CISA due |
|---|---|---|---|---|---|---|---|
| CVE-2026-31431 | Linux | Kernel | Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability | 87 Immediate | 0.999 (99.97th pctl) | Unknown/None | 2026-05-15 |
| CVE-2022-0847 | Linux | Kernel | Linux Kernel Privilege Escalation Vulnerability | 82 Urgent | 0.897 (99.78th pctl) | Unknown/None | 2022-05-16 |
| CVE-2010-1871 | Red Hat | JBoss Seam 2 | Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability | 81 Urgent | 0.834 (99.66th pctl) | Unknown/None | 2022-06-10 |
| CVE-2021-22555 | Linux | Kernel | Linux Kernel Heap Out-of-Bounds Write Vulnerability | 81 Urgent | 0.787 (99.56th pctl) | Unknown/None | 2025-10-27 |
| CVE-2016-5195 | Linux | Kernel | Linux Kernel Race Condition Vulnerability | 79 Urgent | 0.835 (99.66th pctl) | Unknown/None | 2022-03-24 |
| CVE-2019-13272 | Linux | Kernel | Linux Kernel Improper Privilege Management Vulnerability | 75 Urgent | 0.522 (98.9th pctl) | Unknown/None | 2022-06-10 |
| CVE-2021-3493 | Linux | Kernel | Linux Kernel Privilege Escalation Vulnerability | 75 Urgent | 0.492 (98.8th pctl) | Unknown/None | 2022-11-10 |
| CVE-2013-2094 | Linux | Kernel | Linux Kernel Privilege Escalation Vulnerability | 75 Urgent | 0.477 (98.8th pctl) | Unknown/None | 2022-10-06 |
| CVE-2013-6282 | Linux | Kernel | Linux Kernel Improper Input Validation Vulnerability | 75 Urgent | 0.397 (98.5th pctl) | Unknown/None | 2022-10-06 |
| CVE-2014-3153 | Linux | Kernel | Linux Kernel Privilege Escalation Vulnerability | 75 Urgent | 0.372 (98.4th pctl) | Unknown/None | 2022-06-15 |
| CVE-2024-1086 | Linux | Kernel | Linux Kernel Use-After-Free Vulnerability | 75 Urgent | 0.281 (98th pctl) | Known | 2024-06-20 |
| CVE-2022-0185 | Linux | Kernel | Linux Kernel Heap-Based Buffer Overflow Vulnerability | 75 Urgent | 0.252 (97.8th pctl) | Unknown/None | 2024-09-11 |
| CVE-2014-0196 | Linux | Kernel | Linux Kernel Race Condition Vulnerability | 75 Urgent | 0.225 (97.5th pctl) | Unknown/None | 2023-06-02 |
| CVE-2018-14634 | Linux | Kernel | Linux Kernel Integer Overflow Vulnerability | 75 Urgent | 0.147 (96.4th pctl) | Unknown/None | 2026-02-16 |
| CVE-2010-3904 | Linux | Kernel | Linux Kernel Improper Input Validation Vulnerability | 75 Urgent | 0.146 (96.4th pctl) | Unknown/None | 2023-06-02 |
| CVE-2017-1000253 | Linux | Kernel | Linux Kernel PIE Stack Buffer Corruption Vulnerability | 75 Urgent | 0.107 (95.5th pctl) | Known | 2024-09-30 |
| CVE-2022-2586 | Linux | Kernel | Linux Kernel Use-After-Free Vulnerability | 75 Urgent | 0.105 (95.4th pctl) | Unknown/None | 2024-07-17 |
| CVE-2022-0995 | Linux | Kernel | Linux Kernel Out-of-Bounds Write Vulnerability | 75 Urgent | 0.095 (95.1st pctl) | Unknown/None | 2026-09-09 |
| CVE-2023-0386 | Linux | Kernel | Linux Kernel Improper Ownership Management Vulnerability | 75 Urgent | 0.079 (94.3rd pctl) | Unknown/None | 2025-07-08 |
| CVE-2021-22600 | Linux | Kernel | Linux Kernel Privilege Escalation Vulnerability | 75 Urgent | 0.061 (92.9th pctl) | Unknown/None | 2022-05-02 |
| CVE-2022-0492 | Linux | Kernel | Linux Kernel Improper Authentication Vulnerability | 75 Urgent | 0.055 (92.3rd pctl) | Unknown/None | 2026-06-05 |
| CVE-2023-0266 | Linux | Kernel | Linux Kernel Use-After-Free Vulnerability | 75 Urgent | 0.037 (89th pctl) | Unknown/None | 2023-04-20 |
| CVE-2024-53197 | Linux | Kernel | Linux Kernel Out-of-Bounds Access Vulnerability | 75 Urgent | 0.036 (88.5th pctl) | Unknown/None | 2025-04-30 |
| CVE-2013-2596 | Linux | Kernel | Linux Kernel Integer Overflow Vulnerability | 75 Urgent | 0.033 (87.8th pctl) | Unknown/None | 2022-10-06 |
| CVE-2024-53104 | Linux | Kernel | Linux Kernel Out-of-Bounds Write Vulnerability | 75 Urgent | 0.033 (87.7th pctl) | Unknown/None | 2025-02-26 |
Exactly the 29 advisory(ies) matching the filters above.
Advisory detail
Expand any advisory for its description, CISA's own required action, and research links.
CVE-2026-31431 — Linux Kernel: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability
Linux Kernel contains an incorrect resource transfer between spheres vulnerability that could allow for privilege escalation.
Recommended priority: Patch Immediately
Why this score: Listed in the CISA KEV catalog, and an EPSS probability of 0.999.
CISA required action: "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.999 (99.97th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2026-05-01
CISA remediation due: 2026-05-15
Known ransomware campaign use: Unknown/None
CVE-2022-0847 — Linux Kernel: Linux Kernel Privilege Escalation Vulnerability
Linux kernel contains an improper initialization vulnerability where an unprivileged local user could escalate their privileges on the system. This vulnerability has the moniker of "Dirty Pipe."
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and an EPSS probability of 0.897.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.897 (99.78th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-04-25
CISA remediation due: 2022-05-16
Known ransomware campaign use: Unknown/None
CVE-2010-1871 — Red Hat JBoss Seam 2: Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, allows attackers to perform remote code execution. This vulnerability can only be exploited when the Java Security Manager is not properly configured.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and an EPSS probability of 0.834.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.834 (99.66th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2021-12-10
CISA remediation due: 2022-06-10
Known ransomware campaign use: Unknown/None
CVE-2021-22555 — Linux Kernel: Linux Kernel Heap Out-of-Bounds Write Vulnerability
Linux Kernel contains a heap out-of-bounds write vulnerability that could allow an attacker to gain privileges or cause a DoS (via heap memory corruption) through user name space.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and an EPSS probability of 0.787.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.787 (99.56th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2025-10-06
CISA remediation due: 2025-10-27
Known ransomware campaign use: Unknown/None
CVE-2016-5195 — Linux Kernel: Linux Kernel Race Condition Vulnerability
Race condition in mm/gup.c in the Linux kernel allows local users to escalate privileges.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and an EPSS probability of 0.835.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.0 (NVD)
FIRST EPSS: 0.835 (99.66th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-03-03
CISA remediation due: 2022-03-24
Known ransomware campaign use: Unknown/None
CVE-2019-13272 — Linux Kernel: Linux Kernel Improper Privilege Management Vulnerability
Kernel/ptrace.c in Linux kernel mishandles contains an improper privilege management vulnerability that allows local users to obtain root access.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.522 (98.9th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2021-12-10
CISA remediation due: 2022-06-10
Known ransomware campaign use: Unknown/None
CVE-2021-3493 — Linux Kernel: Linux Kernel Privilege Escalation Vulnerability
The overlayfs stacking file system in Linux kernel does not properly validate the application of file capabilities against user namespaces, which could lead to privilege escalation.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.492 (98.8th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-10-20
CISA remediation due: 2022-11-10
Known ransomware campaign use: Unknown/None
CVE-2013-2094 — Linux Kernel: Linux Kernel Privilege Escalation Vulnerability
Linux kernel fails to check all 64 bits of attr.config passed by user space, resulting to out-of-bounds access of the perf_swevent_enabled array in sw_perf_event_destroy(). Explotation allows for privilege escalation.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.4 (NVD)
FIRST EPSS: 0.477 (98.8th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-09-15
CISA remediation due: 2022-10-06
Known ransomware campaign use: Unknown/None
CVE-2013-6282 — Linux Kernel: Linux Kernel Improper Input Validation Vulnerability
The get_user and put_user API functions of the Linux kernel fail to validate the target address when being used on ARM v6k/v7 platforms. This allows an application to read and write kernel memory which could lead to privilege escalation.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 8.8 (NVD)
FIRST EPSS: 0.397 (98.5th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-09-15
CISA remediation due: 2022-10-06
Known ransomware campaign use: Unknown/None
CVE-2014-3153 — Linux Kernel: Linux Kernel Privilege Escalation Vulnerability
The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.372 (98.4th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-05-25
CISA remediation due: 2022-06-15
Known ransomware campaign use: Unknown/None
CVE-2024-1086 — Linux Kernel: Linux Kernel Use-After-Free Vulnerability
Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.281 (98th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2024-05-30
CISA remediation due: 2024-06-20
Known ransomware campaign use: Known
CVE-2022-0185 — Linux Kernel: Linux Kernel Heap-Based Buffer Overflow Vulnerability
Linux kernel contains a heap-based buffer overflow vulnerability in the legacy_parse_param function in the Filesystem Context functionality. This allows an attacker to open a filesystem that does not support the Filesystem Context API and ultimately escalate privileges.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
CVSS: 8.4 (NVD)
FIRST EPSS: 0.252 (97.8th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2024-08-21
CISA remediation due: 2024-09-11
Known ransomware campaign use: Unknown/None
CVE-2014-0196 — Linux Kernel: Linux Kernel Race Condition Vulnerability
Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: The impacted product is end-of-life and should be disconnected if still in use.
CVSS: 5.5 (NVD)
FIRST EPSS: 0.225 (97.5th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2023-05-12
CISA remediation due: 2023-06-02
Known ransomware campaign use: Unknown/None
CVE-2018-14634 — Linux Kernel: Linux Kernel Integer Overflow Vulnerability
Linux Kernel contains an integer overflow vulnerability in the create_elf_tables() function which could allow an unprivileged local user with access to SUID (or otherwise privileged) binary to escalate their privileges on the system.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.147 (96.4th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2026-01-26
CISA remediation due: 2026-02-16
Known ransomware campaign use: Unknown/None
CVE-2010-3904 — Linux Kernel: Linux Kernel Improper Input Validation Vulnerability
Linux Kernel contains an improper input validation vulnerability in the Reliable Datagram Sockets (RDS) protocol implementation that allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: The impacted product is end-of-life and should be disconnected if still in use.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.146 (96.4th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2023-05-12
CISA remediation due: 2023-06-02
Known ransomware campaign use: Unknown/None
CVE-2017-1000253 — Linux Kernel: Linux Kernel PIE Stack Buffer Corruption Vulnerability
Linux kernel contains a position-independent executable (PIE) stack buffer corruption vulnerability in load_elf_ binary() that allows a local attacker to escalate privileges.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.107 (95.5th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2024-09-09
CISA remediation due: 2024-09-30
Known ransomware campaign use: Known
CVE-2022-2586 — Linux Kernel: Linux Kernel Use-After-Free Vulnerability
Linux Kernel contains a use-after-free vulnerability in the nft_object, allowing local attackers to escalate privileges.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.105 (95.4th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2024-06-26
CISA remediation due: 2024-07-17
Known ransomware campaign use: Unknown/None
CVE-2022-0995 — Linux Kernel: Linux Kernel Out-of-Bounds Write Vulnerability
Linux Kernel contains an out-of-bounds memory write vulnerability which could allow a local user to gain privileged access or cause a denial of service on the system.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.095 (95.1st pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2026-08-26
CISA remediation due: 2026-09-09
Known ransomware campaign use: Unknown/None
CVE-2023-0386 — Linux Kernel: Linux Kernel Improper Ownership Management Vulnerability
Linux Kernel contains an improper ownership management vulnerability, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.079 (94.3rd pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2025-06-17
CISA remediation due: 2025-07-08
Known ransomware campaign use: Unknown/None
CVE-2021-22600 — Linux Kernel: Linux Kernel Privilege Escalation Vulnerability
Linux Kernel contains a flaw in the packet socket (AF_PACKET) implementation which could lead to incorrectly freeing memory. A local user could exploit this for denial-of-service (DoS) or possibly for privilege escalation.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.0 (NVD)
FIRST EPSS: 0.061 (92.9th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-04-11
CISA remediation due: 2022-05-02
Known ransomware campaign use: Unknown/None
CVE-2022-0492 — Linux Kernel: Linux Kernel Improper Authentication Vulnerability
Linux Kernel contains an improper authentication vulnerability which could allow for privilege escalation via the cgroups v1 release_agent feature.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.055 (92.3rd pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2026-06-02
CISA remediation due: 2026-06-05
Known ransomware campaign use: Unknown/None
CVE-2023-0266 — Linux Kernel: Linux Kernel Use-After-Free Vulnerability
Linux kernel contains a use-after-free vulnerability that allows for privilege escalation to gain ring0 access from the system user.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.0 (NVD)
FIRST EPSS: 0.037 (89th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2023-03-30
CISA remediation due: 2023-04-20
Known ransomware campaign use: Unknown/None
CVE-2024-53197 — Linux Kernel: Linux Kernel Out-of-Bounds Access Vulnerability
Linux Kernel contains an out-of-bounds access vulnerability in the USB-audio driver that allows an attacker with physical access to the system to use a malicious USB device to potentially manipulate system memory, escalate privileges, or execute arbitrary code.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.036 (88.5th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2025-04-09
CISA remediation due: 2025-04-30
Known ransomware campaign use: Unknown/None
CVE-2013-2596 — Linux Kernel: Linux Kernel Integer Overflow Vulnerability
Linux kernel fb_mmap function in drivers/video/fbmem.c contains an integer overflow vulnerability that allows for privilege escalation.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply updates per vendor instructions.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.033 (87.8th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2022-09-15
CISA remediation due: 2022-10-06
Known ransomware campaign use: Unknown/None
CVE-2024-53104 — Linux Kernel: Linux Kernel Out-of-Bounds Write Vulnerability
Linux kernel contains an out-of-bounds write vulnerability in the uvc_parse_streaming component of the USB Video Class (UVC) driver that could allow for physical escalation of privilege.
Recommended priority: Patch This Cycle
Why this score: Listed in the CISA KEV catalog, and Confirmed exploitation in the wild.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVSS: 7.8 (NVD)
FIRST EPSS: 0.033 (87.7th pctl) — probability of exploitation in the next 30 days, with its rank across all scored CVEs
CISA added: 2025-02-05
CISA remediation due: 2025-02-26
Known ransomware campaign use: Unknown/None