Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 276 | CVE-2021-35395Realtek — Realtek AP-Router SDK Buffer Overflow VulnerabilityExigentKEV since 2021 · listed over a year | 87 | 9.8 | 98.1% · 99.91st | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 277 | CVE-2023-25717Ruckus Wireless — Multiple Ruckus Wireless Products CSRF and RCE VulnerabilityExigentKEV since 2023 · listed over a year | 87 | 9.8 | 98.1% · 99.91st | 2023-05-12 | 2023-06-02KEV since 2023 · listed over a year |
| 278 | CVE-2022-29303SolarView — SolarView Compact Command Injection VulnerabilityExigentKEV since 2023 · listed over a year | 87 | 9.8 | 98.0% · 99.91st | 2023-07-13 | 2023-08-03KEV since 2023 · listed over a year |
| 279 | CVE-2022-22536SAP — SAP Multiple Products HTTP Request Smuggling VulnerabilityExigentKEV since 2022 · listed over a year | 87 | 10.0 | 97.9% · 99.91st | 2022-08-18 | 2022-09-08KEV since 2022 · listed over a year |
| 280 | CVE-2025-34028Commvault — Commvault Command Center Path Traversal VulnerabilityExigentKEV since 2025 · listed over a year | 87 | 9.3 | 97.6% · 99.9th | 2025-05-02 | 2025-05-23KEV since 2025 · listed over a year |
| 281 | CVE-2024-56145Craft CMS — Craft CMS Code Injection VulnerabilityExigentKEV since 2025 · listed over a year | 87 | 9.3 | 97.4% · 99.9th | 2025-06-02 | 2025-06-23KEV since 2025 · listed over a year |
| 282 | CVE-2025-2747Kentico — Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityExigentKEV since 2025 · listed over a year | 87 | 9.8 | 97.2% · 99.9th | 2025-10-20 | 2025-11-10KEV since 2025 · listed over a year |
| 283 | CVE-2024-20439Cisco — Cisco Smart Licensing Utility Static Credential VulnerabilityExigentKEV since 2025 · listed over a year | 87 | 9.8 | 97.1% · 99.89th | 2025-03-31 | 2025-04-21KEV since 2025 · listed over a year |
| 284 | CVE-2024-1212Progress — Progress Kemp LoadMaster OS Command Injection VulnerabilityExigentKEV since 2024 · listed over a year | 87 | 9.8 | 95.4% · 99.87th | 2024-11-18 | 2024-12-09KEV since 2024 · listed over a year |
| 285 | CVE-2025-57819Sangoma — Sangoma FreePBX Authentication Bypass VulnerabilityExigentKEV since 2025 · listed over a year | 87 | 10.0 | 95.0% · 99.86th | 2025-08-29 | 2025-09-19KEV since 2025 · listed over a year |
| 286 | CVE-2024-47575Fortinet — Fortinet FortiManager Missing Authentication VulnerabilityExigentKEV since 2024 · listed over a year | 87 | 9.8 | 94.8% · 99.86th | 2024-10-23 | 2024-11-13KEV since 2024 · listed over a year |
| 287 | CVE-2018-14933NUUO — NUUO NVRmini Devices OS Command Injection VulnerabilityExigentKEV since 2024 · listed over a year | 87 | 9.8 | 94.8% · 99.86th | 2024-12-18 | 2025-01-08KEV since 2024 · listed over a year |
| 288 | CVE-2025-54236Adobe — Adobe Commerce and Magento Improper Input Validation VulnerabilityExigentCISA federal deadline · Overdue by 11 months | 87 | 9.1 | 94.7% · 99.86th | 2025-10-24 | 2025-11-14CISA federal deadline · Overdue by 11 months |
| 289 | CVE-2020-2883Oracle — Oracle WebLogic Server Unspecified VulnerabilityExigentKEV since 2025 · listed over a year | 87 | 9.8 | 94.6% · 99.86th | 2025-01-07 | 2025-01-28KEV since 2025 · listed over a year |
| 290 | CVE-2025-30406Gladinet — Gladinet CentreStack and Triofox Use of Hard-coded Cryptographic Key VulnerabilityExigentKEV since 2025 · listed over a year | 87 | 9.8 | 94.3% · 99.85th | 2025-04-08 | 2025-04-29KEV since 2025 · listed over a year |
| 291 | CVE-2025-47812Wing FTP Server — Wing FTP Server Improper Neutralization of Null Byte or NUL Character VulnerabilityExigentKEV since 2025 · listed over a year | 87 | 10.0 | 93.9% · 99.85th | 2025-07-14 | 2025-08-04KEV since 2025 · listed over a year |
| 292 | CVE-2025-24016Wazuh — Wazuh Server Deserialization of Untrusted Data VulnerabilityExigentKEV since 2025 · listed over a year | 87 | 9.9 | 93.8% · 99.85th | 2025-06-10 | 2025-07-01KEV since 2025 · listed over a year |
| 293 | CVE-2025-34291Langflow — Langflow Origin Validation Error VulnerabilityExigentCISA federal deadline · Overdue by 5 months | 87 | 9.4 | 92.8% · 99.83rd | 2026-05-21 | 2026-06-04CISA federal deadline · Overdue by 5 months |
| 294 | CVE-2025-9242WatchGuard — WatchGuard Firebox Out-of-Bounds Write VulnerabilityExigentCISA federal deadline · Overdue by 11 months | 87 | 9.3 | 91.8% · 99.82nd | 2025-11-12 | 2025-12-03CISA federal deadline · Overdue by 11 months |
| 295 | CVE-2025-37164Hewlett Packard Enterprise (HPE) — Hewlett Packard Enterprise (HPE) OneView Code Injection VulnerabilityExigentCISA federal deadline · Overdue by 9 months | 87 | 9.8 | 90.2% · 99.8th | 2026-01-07 | 2026-01-28CISA federal deadline · Overdue by 9 months |
| 296 | CVE-2009-3960Adobe — Adobe BlazeDS Information Disclosure VulnerabilityRansomwareKEV since 2022 · listed over a year | 87 | 6.5 | 90.1% · 99.8th | 2022-03-07 | 2022-09-07KEV since 2022 · listed over a year |
| 297 | CVE-2025-61757Oracle — Oracle Fusion Middleware Missing Authentication for Critical Function VulnerabilityCISA federal deadline · Overdue by 10 months | 87 | 9.8 | 88.6% · 99.78th | 2025-11-21 | 2025-12-12CISA federal deadline · Overdue by 10 months |
| 298 | CVE-2026-48908JoomShaper — JoomShaper SP Page Builder Unrestricted Upload of File with Dangerous Type VulnerabilityCISA federal deadline · Overdue by 3 months | 87 | 10.0 | 88.5% · 99.78th | 2026-07-07 | 2026-07-10CISA federal deadline · Overdue by 3 months |
| 299 | CVE-2026-20127Cisco — Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass VulnerabilityCISA federal deadline · Overdue by 8 months | 87 | 10.0 | 88.5% · 99.77th | 2026-02-25 | 2026-02-27CISA federal deadline · Overdue by 8 months |
| 300 | CVE-2021-23758Ajax.NET Professional — Ajax.NET Professional Deserialization of Untrusted Data VulnerabilityCISA federal deadline · Overdue by 44 days | 87 | 9.8 | 82.6% · 99.67th | 2026-08-26 | 2026-09-09CISA federal deadline · Overdue by 44 days |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.