Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,366 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 626 | CVE-2016-2386SAP — SAP NetWeaver SQL Injection VulnerabilityKEV since 2022 · listed over a year | 79 | 9.8 | 71.5% · 99.42nd | 2022-06-09 | 2022-06-30KEV since 2022 · listed over a year |
| 627 | CVE-2020-4427IBM — IBM Data Risk Manager Security Bypass VulnerabilityKEV since 2021 · listed over a year | 79 | 9.8 | 70.0% · 99.38th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 628 | CVE-2021-44026Roundcube — Roundcube Webmail SQL Injection VulnerabilityKEV since 2023 · listed over a year | 79 | 9.8 | 69.9% · 99.38th | 2023-06-22 | 2023-07-13KEV since 2023 · listed over a year |
| 629 | CVE-2017-6077NETGEAR — NETGEAR DGN2200 Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 79 | 9.8 | 68.7% · 99.34th | 2022-03-07 | 2022-09-07KEV since 2022 · listed over a year |
| 630 | CVE-2025-2776SysAid — SysAid On-Prem Improper Restriction of XML External Entity Reference VulnerabilityKEV since 2025 · listed over a year | 79 | 9.8 | 64.7% · 99.25th | 2025-07-22 | 2025-08-12KEV since 2025 · listed over a year |
| 631 | CVE-2025-58360OSGeo — OSGeo GeoServer Improper Restriction of XML External Entity Reference VulnerabilityCISA federal deadline · Overdue by 10 months | 79 | 9.8 | 60.0% · 99.13rd | 2025-12-11 | 2026-01-01CISA federal deadline · Overdue by 10 months |
| 632 | CVE-2026-85102Check Point — Check Point Multiple Products Improper Certificate Validation VulnerabilityCISA federal deadline · Overdue by 30 days | 79 | 9.8 | 54.2% · 99.01st | 2026-09-22 | 2026-09-25CISA federal deadline · Overdue by 30 days |
| 633 | CVE-2023-36844Juniper — Juniper Junos OS EX Series PHP External Variable Modification VulnerabilityKEV since 2023 · listed over a year | 78 | 5.3 | 90.0% · 99.8th | 2023-11-13 | 2023-11-17KEV since 2023 · listed over a year |
| 634 | CVE-2021-21973VMware — VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) VulnerabilityKEV since 2022 · listed over a year | 78 | 5.3 | 88.0% · 99.77th | 2022-03-07 | 2022-03-21KEV since 2022 · listed over a year |
| 635 | CVE-2023-49103ownCloud — ownCloud graphapi Information Disclosure VulnerabilityKEV since 2023 · listed over a year | 78 | 7.5 | 78.4% · 99.59th | 2023-11-30 | 2023-12-21KEV since 2023 · listed over a year |
| 636 | CVE-2020-8816Pi-hole — Pi-Hole AdminLTE Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 78 | 7.2 | 78.3% · 99.58th | 2021-12-10 | 2022-06-10KEV since 2021 · listed over a year |
| 637 | CVE-2021-38406Delta Electronics — Delta Electronics DOPSoft 2 Improper Input Validation VulnerabilityKEV since 2022 · listed over a year | 78 | 7.8 | 76.4% · 99.54th | 2022-08-25 | 2022-09-15KEV since 2022 · listed over a year |
| 638 | CVE-2018-15811DotNetNuke (DNN) — DotNetNuke (DNN) Inadequate Encryption Strength VulnerabilityKEV since 2021 · listed over a year | 78 | 7.5 | 76.3% · 99.54th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 639 | CVE-2023-44221SonicWall — SonicWall SMA100 Appliances OS Command Injection VulnerabilityKEV since 2025 · listed over a year | 78 | 7.2 | 76.2% · 99.54th | 2025-05-01 | 2025-05-22KEV since 2025 · listed over a year |
| 640 | CVE-2021-30860Apple — Apple Multiple Products Integer Overflow VulnerabilityKEV since 2021 · listed over a year | 78 | 7.8 | 76.0% · 99.53rd | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 641 | CVE-2017-6334NETGEAR — NETGEAR DGN2200 Devices OS Command Injection VulnerabilityKEV since 2022 · listed over a year | 78 | 8.8 | 72.6% · 99.45th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 642 | CVE-2021-25296Nagios — Nagios XI OS Command InjectionKEV since 2022 · listed over a year | 78 | 8.8 | 71.9% · 99.43rd | 2022-01-18 | 2022-02-01KEV since 2022 · listed over a year |
| 643 | CVE-2024-20353Cisco — Cisco ASA and FTD Denial of Service VulnerabilityKEV since 2024 · listed over a year | 78 | 8.6 | 70.7% · 99.4th | 2024-04-24 | 2024-05-01KEV since 2024 · listed over a year |
| 644 | CVE-2021-21220Google — Google Chromium V8 Improper Input Validation VulnerabilityKEV since 2021 · listed over a year | 78 | 8.8 | 70.4% · 99.39th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 645 | CVE-2017-6736Cisco — Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 78 | 8.8 | 70.4% · 99.39th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 646 | CVE-2016-20017D-Link — D-Link DSL-2750B Devices Command Injection VulnerabilityKEV since 2024 · listed over a year | 78 | 9.8 | 66.6% · 99.29th | 2024-01-08 | 2024-01-29KEV since 2024 · listed over a year |
| 647 | CVE-2013-2729Adobe — Adobe Reader and Acrobat Arbitrary Integer Overflow VulnerabilityKEV since 2022 · listed over a year | 78 | 9.8 | 66.6% · 99.29th | 2022-03-28 | 2022-04-18KEV since 2022 · listed over a year |
| 648 | CVE-2025-31125Vite — Vite Vitejs Improper Access Control VulnerabilityCISA federal deadline · Overdue by 8 months | 78 | 7.5 | 65.8% · 99.27th | 2026-01-22 | 2026-02-12CISA federal deadline · Overdue by 8 months |
| 649 | CVE-2015-7755Juniper — Juniper ScreenOS Improper Authentication VulnerabilityKEV since 2025 · listed over a year | 78 | 9.8 | 61.1% · 99.16th | 2025-10-02 | 2025-10-23KEV since 2025 · listed over a year |
| 650 | CVE-2024-54085AMI — AMI MegaRAC SPx Authentication Bypass by Spoofing VulnerabilityKEV since 2025 · listed over a year | 78 | 10.0 | 60.7% · 99.15th | 2025-06-25 | 2025-07-16KEV since 2025 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.