Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,366 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 651 | CVE-2019-19006Sangoma — Sangoma FreePBX Improper Authentication VulnerabilityCISA federal deadline · Overdue by 8 months | 78 | 9.8 | 55.9% · 99.05th | 2026-02-03 | 2026-02-24CISA federal deadline · Overdue by 8 months |
| 652 | CVE-2022-37055D-Link — D-Link Routers Buffer Overflow VulnerabilityCISA federal deadline · Overdue by 10 months | 78 | 9.8 | 55.5% · 99.04th | 2025-12-08 | 2025-12-29CISA federal deadline · Overdue by 10 months |
| 653 | CVE-2023-36847Juniper — Juniper Junos OS EX Series Missing Authentication for Critical Function VulnerabilityKEV since 2023 · listed over a year | 77 | 5.3 | 83.5% · 99.69th | 2023-11-13 | 2023-11-17KEV since 2023 · listed over a year |
| 654 | CVE-2018-18809TIBCO — TIBCO JasperReports Library Directory Traversal VulnerabilityKEV since 2022 · listed over a year | 77 | 6.5 | 79.1% · 99.6th | 2022-12-29 | 2023-01-19KEV since 2022 · listed over a year |
| 655 | CVE-2018-8298ChakraCore — ChakraCore Scripting Engine Type Confusion VulnerabilityKEV since 2022 · listed over a year | 77 | 7.5 | 74.7% · 99.5th | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 656 | CVE-2018-18325DotNetNuke (DNN) — DotNetNuke (DNN) Inadequate Encryption Strength VulnerabilityKEV since 2021 · listed over a year | 77 | 7.5 | 74.0% · 99.49th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 657 | CVE-2019-2215Android — Android Kernel Use-After-Free VulnerabilityKEV since 2021 · listed over a year | 77 | 7.8 | 72.1% · 99.43rd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 658 | CVE-2012-1535Adobe — Adobe Flash Player Arbitrary Code Execution VulnerabilityKEV since 2022 · listed over a year | 77 | 7.8 | 70.4% · 99.39th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 659 | CVE-2013-1690Mozilla — Mozilla Firefox and Thunderbird Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 77 | 8.8 | 69.0% · 99.36th | 2022-03-28 | 2022-04-18KEV since 2022 · listed over a year |
| 660 | CVE-2015-4495Mozilla — Mozilla Firefox Security Feature Bypass VulnerabilityKEV since 2022 · listed over a year | 77 | 8.8 | 68.6% · 99.34th | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 661 | CVE-2015-8651Adobe — Adobe Flash Player Integer Overflow VulnerabilityKEV since 2022 · listed over a year | 77 | 8.8 | 67.7% · 99.32nd | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 662 | CVE-2016-4657Apple — Apple iOS Webkit Memory Corruption VulnerabilityKEV since 2022 · listed over a year | 77 | 8.8 | 66.8% · 99.3rd | 2022-05-24 | 2022-06-14KEV since 2022 · listed over a year |
| 663 | CVE-2020-15999Google — Google Chrome FreeType Heap Buffer Overflow VulnerabilityKEV since 2021 · listed over a year | 77 | 9.6 | 63.9% · 99.23rd | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 664 | CVE-2022-21445Oracle — Oracle ADF Faces Deserialization of Untrusted Data VulnerabilityKEV since 2024 · listed over a year | 77 | 9.8 | 62.5% · 99.19th | 2024-09-18 | 2024-10-09KEV since 2024 · listed over a year |
| 665 | CVE-2018-4939Adobe — Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityKEV since 2021 · listed over a year | 77 | 9.8 | 62.0% · 99.18th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 666 | CVE-2024-23113Fortinet — Fortinet Multiple Products Format String VulnerabilityKEV since 2024 · listed over a year | 77 | 9.8 | 61.7% · 99.17th | 2024-10-09 | 2024-10-30KEV since 2024 · listed over a year |
| 667 | CVE-2021-22991F5 — F5 BIG-IP Traffic Management Microkernel Buffer OverflowKEV since 2022 · listed over a year | 77 | 9.8 | 61.1% · 99.16th | 2022-01-18 | 2022-02-01KEV since 2022 · listed over a year |
| 668 | CVE-2018-7445MikroTik — MikroTik RouterOS Stack-Based Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 77 | 9.8 | 60.8% · 99.15th | 2022-09-08 | 2022-09-29KEV since 2022 · listed over a year |
| 669 | CVE-2021-22175GitLab — GitLab Server-Side Request Forgery (SSRF) VulnerabilityCISA federal deadline · Overdue by 7 months | 77 | 9.8 | 53.4% · 99th | 2026-02-18 | 2026-03-11CISA federal deadline · Overdue by 7 months |
| 670 | CVE-2019-1579Palo Alto Networks — Palo Alto Networks PAN-OS Remote Code Execution VulnerabilityRansomwareKEV since 2022 · listed over a year | 77 | 8.1 | 46.2% · 98.8th | 2022-01-10 | 2022-07-10KEV since 2022 · listed over a year |
| 671 | CVE-2020-13965Roundcube — Roundcube Webmail Cross-Site Scripting (XSS) VulnerabilityKEV since 2024 · listed over a year | 76 | 6.1 | 76.6% · 99.54th | 2024-06-26 | 2024-07-17KEV since 2024 · listed over a year |
| 672 | CVE-2020-5741Plex — Plex Media Server Remote Code Execution VulnerabilityKEV since 2023 · listed over a year | 76 | 7.2 | 72.8% · 99.45th | 2023-03-10 | 2023-03-31KEV since 2023 · listed over a year |
| 673 | CVE-2020-36193PEAR — PEAR Archive_Tar Improper Link Resolution VulnerabilityKEV since 2022 · listed over a year | 76 | 7.5 | 70.6% · 99.39th | 2022-08-25 | 2022-09-15KEV since 2022 · listed over a year |
| 674 | CVE-2019-18426Meta Platforms — WhatsApp Cross-Site Scripting VulnerabilityKEV since 2022 · listed over a year | 76 | 8.2 | 67.9% · 99.32nd | 2022-05-23 | 2022-06-13KEV since 2022 · listed over a year |
| 675 | CVE-2025-04117-Zip — 7-Zip Mark of the Web Bypass VulnerabilityKEV since 2025 · listed over a year | 76 | 7.0 | 67.1% · 99.3rd | 2025-02-06 | 2025-02-27KEV since 2025 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.