Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 526 | CVE-2024-0769D-Link — D-Link DIR-859 Router Path Traversal VulnerabilityKEV since 2025 · listed over a year | 83 | 9.8 | 82.7% · 99.67th | 2025-06-25 | 2025-07-16KEV since 2025 · listed over a year |
| 527 | CVE-2026-16232Check Point — Check Point SmartConsole Improper Authentication VulnerabilityCISA federal deadline · Overdue by 3 months | 83 | 9.3 | 78.0% · 99.58th | 2026-07-22 | 2026-07-25CISA federal deadline · Overdue by 3 months |
| 528 | CVE-2026-25089Fortinet — Fortinet FortiSandbox OS Command Injection VulnerabilityCISA federal deadline · Overdue by 3 months | 83 | 9.8 | 76.1% · 99.53rd | 2026-07-16 | 2026-07-19CISA federal deadline · Overdue by 3 months |
| 529 | CVE-2025-40536SolarWinds — SolarWinds Web Help Desk Security Control Bypass VulnerabilityCISA federal deadline · Overdue by 8 months | 83 | 9.8 | 73.6% · 99.47th | 2026-02-12 | 2026-02-15CISA federal deadline · Overdue by 8 months |
| 530 | CVE-2026-73570Synacor — Zimbra Collaboration Suite (ZCS) OS Command Injection VulnerabilityCISA federal deadline · Overdue by 2 months | 83 | 8.9 | 71.7% · 99.42nd | 2026-08-21 | 2026-08-24CISA federal deadline · Overdue by 2 months |
| 531 | CVE-2020-3259Cisco — Cisco ASA and FTD Information Disclosure VulnerabilityRansomwareKEV since 2024 · listed over a year | 83 | 7.5 | 71.5% · 99.42nd | 2024-02-15 | 2024-03-07KEV since 2024 · listed over a year |
| 532 | CVE-2024-57728SimpleHelp — SimpleHelp Path Traversal VulnerabilityRansomwareCISA federal deadline · Overdue by 6 months | 83 | 7.2 | 64.5% · 99.24th | 2026-04-24 | 2026-05-08CISA federal deadline · Overdue by 6 months |
| 533 | CVE-2021-26086Atlassian — Atlassian Jira Server and Data Center Path Traversal VulnerabilityKEV since 2024 · listed over a year | 82 | 5.3 | 100.0% · 99.99th | 2024-11-12 | 2024-12-03KEV since 2024 · listed over a year |
| 534 | CVE-2020-5849Unraid — Unraid Authentication Bypass VulnerabilityKEV since 2021 · listed over a year | 82 | 7.5 | 93.2% · 99.84th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 535 | CVE-2023-20273Cisco — Cisco IOS XE Web UI Command Injection VulnerabilityKEV since 2023 · listed over a year | 82 | 7.2 | 93.0% · 99.83rd | 2023-10-23 | 2023-10-27KEV since 2023 · listed over a year |
| 536 | CVE-2022-0847Linux — Linux Kernel Privilege Escalation VulnerabilityKEV since 2022 · listed over a year | 82 | 7.8 | 92.8% · 99.83rd | 2022-04-25 | 2022-05-16KEV since 2022 · listed over a year |
| 537 | CVE-2019-2616Oracle — Oracle BI Publisher Unauthorized Access VulnerabilityKEV since 2022 · listed over a year | 82 | 7.2 | 92.2% · 99.82nd | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 538 | CVE-2012-0754Adobe — Adobe Flash Player Memory Corruption VulnerabilityKEV since 2022 · listed over a year | 82 | 8.1 | 91.1% · 99.81st | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 539 | CVE-2021-21315Npm package — System Information Library for Node.JS Command InjectionKEV since 2022 · listed over a year | 82 | 7.8 | 90.7% · 99.81st | 2022-01-18 | 2022-02-01KEV since 2022 · listed over a year |
| 540 | CVE-2024-13161Ivanti — Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityKEV since 2025 · listed over a year | 82 | 7.5 | 89.8% · 99.79th | 2025-03-10 | 2025-03-31KEV since 2025 · listed over a year |
| 541 | CVE-2017-5521NETGEAR — NETGEAR Multiple Devices Exposure of Sensitive Information VulnerabilityKEV since 2022 · listed over a year | 82 | 8.1 | 89.4% · 99.79th | 2022-09-08 | 2022-09-29KEV since 2022 · listed over a year |
| 542 | CVE-2014-3120Elastic — Elasticsearch Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 82 | 8.1 | 88.6% · 99.78th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 543 | CVE-2021-43798Grafana Labs — Grafana Path Traversal VulnerabilityKEV since 2025 · listed over a year | 82 | 7.5 | 88.5% · 99.78th | 2025-10-09 | 2025-10-30KEV since 2025 · listed over a year |
| 544 | CVE-2016-6366Cisco — Cisco Adaptive Security Appliance (ASA) SNMP Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 82 | 8.8 | 87.6% · 99.76th | 2022-05-24 | 2022-06-14KEV since 2022 · listed over a year |
| 545 | CVE-2021-21017Adobe — Adobe Acrobat and Reader Heap-based Buffer Overflow VulnerabilityKEV since 2021 · listed over a year | 82 | 8.8 | 86.3% · 99.74th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 546 | CVE-2018-17463Google — Google Chromium V8 Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 82 | 8.8 | 84.6% · 99.7th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 547 | CVE-2021-21224Google — Google Chromium V8 Type Confusion VulnerabilityKEV since 2021 · listed over a year | 82 | 8.8 | 84.2% · 99.7th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 548 | CVE-2021-27561Yealink — Yealink Device Management Server-Side Request Forgery (SSRF) VulnerabilityKEV since 2021 · listed over a year | 82 | 9.8 | 82.9% · 99.67th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 549 | CVE-2015-1187D-Link and TRENDnet — D-Link and TRENDnet Multiple Devices Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 82 | 9.8 | 82.9% · 99.67th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 550 | CVE-2023-27992Zyxel — Zyxel Multiple NAS Devices Command Injection VulnerabilityKEV since 2023 · listed over a year | 82 | 9.8 | 82.3% · 99.66th | 2023-06-23 | 2023-07-14KEV since 2023 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.