Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 1 | CVE-2025-55182Meta — Meta React Server Components Remote Code Execution VulnerabilityCISA federal deadline · Overdue by 10 months | 97 | 10.0 | 99.8% · 99.96th | 2025-12-05 | 2025-12-12CISA federal deadline · Overdue by 10 months |
| 2 | CVE-2026-35273Oracle — Oracle PeopleSoft Enterprise PeopleTools Missing Authentication for Critical Function VulnerabilityCISA federal deadline · Overdue by 4 months | 96 | 9.8 | 96.7% · 99.89th | 2026-06-12 | 2026-06-15CISA federal deadline · Overdue by 4 months |
| 3 | CVE-2025-3248Langflow — Langflow Missing Authentication VulnerabilityKEV since 2025 · listed over a year | 95 | 9.8 | 100.0% · 99.99th | 2025-05-05 | 2025-05-26KEV since 2025 · listed over a year |
| 4 | CVE-2025-22457Ivanti — Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityKEV since 2025 · listed over a year | 95 | 9.8 | 100.0% · 99.98th | 2025-04-04 | 2025-04-11KEV since 2025 · listed over a year |
| 5 | CVE-2025-31161CrushFTP — CrushFTP Authentication Bypass VulnerabilityKEV since 2025 · listed over a year | 95 | 9.8 | 100.0% · 99.98th | 2025-04-07 | 2025-04-28KEV since 2025 · listed over a year |
| 6 | CVE-2025-10035Fortra — Fortra GoAnywhere MFT Deserialization of Untrusted Data VulnerabilityKEV since 2025 · listed over a year | 95 | 9.8 | 99.8% · 99.96th | 2025-09-29 | 2025-10-20KEV since 2025 · listed over a year |
| 7 | CVE-2025-61882Oracle — Oracle E-Business Suite Unspecified VulnerabilityKEV since 2025 · listed over a year | 95 | 9.8 | 99.7% · 99.95th | 2025-10-06 | 2025-10-27KEV since 2025 · listed over a year |
| 8 | CVE-2025-31324SAP — SAP NetWeaver Unrestricted File Upload VulnerabilityKEV since 2025 · listed over a year | 95 | 9.8 | 99.5% · 99.94th | 2025-04-29 | 2025-05-20KEV since 2025 · listed over a year |
| 9 | CVE-2026-41940WebPros — WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityCISA federal deadline · Overdue by 6 months | 95 | 9.3 | 98.5% · 99.92nd | 2026-04-30 | 2026-05-03CISA federal deadline · Overdue by 6 months |
| 10 | CVE-2026-23760SmarterTools — SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel VulnerabilityCISA federal deadline · Overdue by 8 months | 95 | 9.3 | 96.4% · 99.88th | 2026-01-26 | 2026-02-16CISA federal deadline · Overdue by 8 months |
| 11 | CVE-2026-1731BeyondTrust — BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) OS Command Injection VulnerabilityCISA federal deadline · Overdue by 8 months | 95 | 9.9 | 92.5% · 99.83rd | 2026-02-13 | 2026-02-16CISA federal deadline · Overdue by 8 months |
| 12 | CVE-2026-63077JetBrains — JetBrains TeamCity Deserialization of Untrusted Data VulnerabilityCISA federal deadline · Overdue by 2 months | 95 | 9.8 | 89.6% · 99.79th | 2026-08-05 | 2026-08-08CISA federal deadline · Overdue by 2 months |
| 13 | CVE-2017-5638Apache — Apache Struts Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 14 | CVE-2018-13379Fortinet — Fortinet FortiOS SSL VPN Path Traversal VulnerabilityKEV since 2021 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 15 | CVE-2019-11510Ivanti — Ivanti Pulse Connect Secure Arbitrary File Read VulnerabilityKEV since 2021 · listed over a year | 94 | 10.0 | 100.0% · 99.99th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 16 | CVE-2019-19781Citrix — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution VulnerabilityKEV since 2021 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 17 | CVE-2020-5902F5 — F5 BIG-IP Traffic Management User Interface (TMUI) Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 18 | CVE-2021-21985VMware — VMware vCenter Server Improper Input Validation VulnerabilityKEV since 2021 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 19 | CVE-2021-22005VMware — VMware vCenter Server File Upload VulnerabilityKEV since 2021 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 20 | CVE-2021-26084Atlassian — Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection VulnerabilityKEV since 2021 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 21 | CVE-2021-35464ForgeRock — ForgeRock Access Management (AM) Core Server Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 22 | CVE-2021-44228Apache — Apache Log4j2 Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 94 | 10.0 | 100.0% · 99.99th | 2021-12-10 | 2021-12-24KEV since 2021 · listed over a year |
| 23 | CVE-2022-26134Atlassian — Atlassian Confluence Server and Data Center Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2022-06-02 | 2022-06-06KEV since 2022 · listed over a year |
| 24 | CVE-2022-29464WSO2 — WSO2 Multiple Products Unrestrictive Upload of File VulnerabilityKEV since 2022 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2022-04-25 | 2022-05-16KEV since 2022 · listed over a year |
| 25 | CVE-2023-22518Atlassian — Atlassian Confluence Data Center and Server Improper Authorization VulnerabilityKEV since 2023 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2023-11-07 | 2023-11-28KEV since 2023 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.