Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 376 | CVE-2019-3398Atlassian — Atlassian Confluence Server and Data Center Path Traversal VulnerabilityKEV since 2021 · listed over a year | 85 | 8.8 | 97.0% · 99.89th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 377 | CVE-2009-0927Adobe — Adobe Reader and Adobe Acrobat Stack-Based Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 85 | 8.8 | 96.6% · 99.89th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 378 | CVE-2018-14847MikroTik — MikroTik Router OS Directory Traversal VulnerabilityExigentKEV since 2021 · listed over a year | 85 | 9.1 | 96.0% · 99.88th | 2021-12-01 | 2022-06-01KEV since 2021 · listed over a year |
| 379 | CVE-2024-48248NAKIVO — NAKIVO Backup and Replication Absolute Path Traversal VulnerabilityKEV since 2025 · listed over a year | 85 | 8.6 | 94.4% · 99.85th | 2025-03-19 | 2025-04-09KEV since 2025 · listed over a year |
| 380 | CVE-2017-1000486Primetek — Primetek Primefaces Remote Code Execution VulnerabilityExigentKEV since 2022 · listed over a year | 85 | 9.8 | 94.1% · 99.85th | 2022-01-10 | 2022-07-10KEV since 2022 · listed over a year |
| 381 | CVE-2015-5122Adobe — Adobe Flash Player Use-After-Free VulnerabilityExigentKEV since 2022 · listed over a year | 85 | 9.8 | 93.9% · 99.85th | 2022-04-13 | 2022-05-04KEV since 2022 · listed over a year |
| 382 | CVE-2013-0625Adobe — Adobe ColdFusion Authentication Bypass VulnerabilityExigentKEV since 2022 · listed over a year | 85 | 9.8 | 93.8% · 99.84th | 2022-03-07 | 2022-09-07KEV since 2022 · listed over a year |
| 383 | CVE-2013-0632Adobe — Adobe ColdFusion Authentication Bypass VulnerabilityExigentKEV since 2022 · listed over a year | 85 | 9.8 | 93.6% · 99.84th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 384 | CVE-2025-4008Smartbedded — Smartbedded Meteobridge Command Injection VulnerabilityKEV since 2025 · listed over a year | 85 | 8.7 | 93.3% · 99.84th | 2025-10-02 | 2025-10-23KEV since 2025 · listed over a year |
| 385 | CVE-2024-28987SolarWinds — SolarWinds Web Help Desk Hardcoded Credential VulnerabilityExigentKEV since 2024 · listed over a year | 85 | 9.1 | 93.3% · 99.84th | 2024-10-15 | 2024-11-05KEV since 2024 · listed over a year |
| 386 | CVE-2021-44077Zoho — Zoho ManageEngine ServiceDesk Plus Remote Code Execution VulnerabilityExigentKEV since 2021 · listed over a year | 85 | 9.8 | 93.3% · 99.84th | 2021-12-01 | 2021-12-15KEV since 2021 · listed over a year |
| 387 | CVE-2016-4437Apache — Apache Shiro Code Execution VulnerabilityExigentKEV since 2021 · listed over a year | 85 | 9.8 | 93.0% · 99.83rd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 388 | CVE-2021-40870Aviatrix — Aviatrix Controller Unrestricted Upload of FileExigentKEV since 2022 · listed over a year | 85 | 9.8 | 93.0% · 99.83rd | 2022-01-18 | 2022-02-01KEV since 2022 · listed over a year |
| 389 | CVE-2018-10561Dasan — Dasan GPON Routers Authentication Bypass VulnerabilityExigentKEV since 2022 · listed over a year | 85 | 9.8 | 92.8% · 99.83rd | 2022-03-31 | 2022-04-21KEV since 2022 · listed over a year |
| 390 | CVE-2020-2551Oracle — Oracle Fusion Middleware Unspecified VulnerabilityExigentKEV since 2023 · listed over a year | 85 | 9.8 | 92.8% · 99.83rd | 2023-11-16 | 2023-12-07KEV since 2023 · listed over a year |
| 391 | CVE-2022-24706Apache — Apache CouchDB Insecure Default Initialization of Resource VulnerabilityExigentKEV since 2022 · listed over a year | 85 | 9.8 | 92.5% · 99.83rd | 2022-08-25 | 2022-09-15KEV since 2022 · listed over a year |
| 392 | CVE-2016-3427Oracle — Oracle Java SE and JRockit Unspecified VulnerabilityExigentKEV since 2023 · listed over a year | 85 | 9.8 | 92.3% · 99.83rd | 2023-05-12 | 2023-06-02KEV since 2023 · listed over a year |
| 393 | CVE-2017-5689Intel — Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation VulnerabilityExigentKEV since 2022 · listed over a year | 85 | 9.8 | 92.2% · 99.82nd | 2022-01-28 | 2022-07-28KEV since 2022 · listed over a year |
| 394 | CVE-2025-11371Gladinet — Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties VulnerabilityCISA federal deadline · Overdue by 11 months | 85 | 7.5 | 92.1% · 99.82nd | 2025-11-04 | 2025-11-25CISA federal deadline · Overdue by 11 months |
| 395 | CVE-2020-10148SolarWinds — SolarWinds Orion Authentication Bypass VulnerabilityExigentKEV since 2021 · listed over a year | 85 | 9.8 | 92.0% · 99.82nd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 396 | CVE-2020-8657EyesOfNetwork — EyesOfNetwork Use of Hard-Coded Credentials VulnerabilityExigentKEV since 2021 · listed over a year | 85 | 9.8 | 91.9% · 99.82nd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 397 | CVE-2024-5910Palo Alto Networks — Palo Alto Networks Expedition Missing Authentication VulnerabilityExigentKEV since 2024 · listed over a year | 85 | 9.3 | 91.7% · 99.82nd | 2024-11-07 | 2024-11-28KEV since 2024 · listed over a year |
| 398 | CVE-2022-26258D-Link — D-Link DIR-820L Remote Code Execution VulnerabilityExigentKEV since 2022 · listed over a year | 85 | 9.8 | 91.6% · 99.81st | 2022-09-08 | 2022-09-29KEV since 2022 · listed over a year |
| 399 | CVE-2012-5076Oracle — Oracle Java SE Sandbox Bypass VulnerabilityExigentKEV since 2022 · listed over a year | 85 | 9.8 | 91.2% · 99.81st | 2022-03-28 | 2022-04-18KEV since 2022 · listed over a year |
| 400 | CVE-2025-6218RARLAB — RARLAB WinRAR Path Traversal VulnerabilityCISA federal deadline · Overdue by 10 months | 85 | 7.8 | 90.5% · 99.8th | 2025-12-09 | 2025-12-30CISA federal deadline · Overdue by 10 months |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.