Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,366 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 801 | CVE-2021-37975Google — Google Chromium V8 Use-After-Free VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 34.9% · 98.4th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 802 | CVE-2016-5198Google — Google Chromium V8 Out-of-Bounds Memory VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 34.2% · 98.4th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 803 | CVE-2020-2509QNAP — QNAP Network-Attached Storage (NAS) Command Injection VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 34.0% · 98.4th | 2022-04-11 | 2022-05-02KEV since 2022 · listed over a year |
| 804 | CVE-2008-4128Cisco — Cisco IOS Cross-Site Request Forgery VulnerabilityCISA federal deadline · Overdue by 3 months | 75 | 8.1 | 33.9% · 98.4th | 2026-07-13 | 2026-07-16CISA federal deadline · Overdue by 3 months |
| 805 | CVE-2022-40799D-Link — D-Link DNR-322L Download of Code Without Integrity Check VulnerabilityKEV since 2025 · listed over a year | 75 | 8.8 | 33.7% · 98.4th | 2025-08-05 | 2025-08-26KEV since 2025 · listed over a year |
| 806 | CVE-2018-13383Fortinet — Fortinet FortiOS and FortiProxy Out-of-bounds WriteRansomwareKEV since 2022 · listed over a year | 75 | 6.5 | 33.6% · 98.4th | 2022-01-10 | 2022-07-10KEV since 2022 · listed over a year |
| 807 | CVE-2020-9715Adobe — Adobe Acrobat Use-After-Free VulnerabilityCISA federal deadline · Overdue by 6 months | 75 | 7.8 | 33.5% · 98.4th | 2026-04-13 | 2026-04-27CISA federal deadline · Overdue by 6 months |
| 808 | CVE-2016-4655Apple — Apple iOS Information Disclosure VulnerabilityKEV since 2022 · listed over a year | 75 | 5.5 | 33.4% · 98.4th | 2022-05-24 | 2022-06-14KEV since 2022 · listed over a year |
| 809 | CVE-2021-30633Google — Google Chromium Indexed DB API Use-After-Free VulnerabilityKEV since 2021 · listed over a year | 75 | 9.6 | 33.2% · 98.4th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 810 | CVE-2020-8195Citrix — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityKEV since 2021 · listed over a year | 75 | 6.5 | 33.0% · 98.4th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 811 | CVE-2017-6884Zyxel — Zyxel EMG2926 Routers Command Injection VulnerabilityRansomwareKEV since 2023 · listed over a year | 75 | 8.8 | 33.0% · 98.4th | 2023-09-18 | 2023-10-09KEV since 2023 · listed over a year |
| 812 | CVE-2020-35730Roundcube — Roundcube Webmail Cross-Site Scripting (XSS) VulnerabilityKEV since 2023 · listed over a year | 75 | 6.1 | 32.9% · 98.4th | 2023-06-22 | 2023-07-13KEV since 2023 · listed over a year |
| 813 | CVE-2025-20393Cisco — Cisco Multiple Products Improper Input Validation VulnerabilityCISA federal deadline · Overdue by 10 months | 75 | 10.0 | 32.4% · 98.3rd | 2025-12-17 | 2025-12-24CISA federal deadline · Overdue by 10 months |
| 814 | CVE-2013-0641Adobe — Adobe Reader Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 32.3% · 98.3rd | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 815 | CVE-2024-57968Advantive — Advantive VeraCore Unrestricted File Upload VulnerabilityKEV since 2025 · listed over a year | 75 | 8.8 | 32.3% · 98.3rd | 2025-03-10 | 2025-03-31KEV since 2025 · listed over a year |
| 816 | CVE-2020-8218Pulse Secure — Pulse Connect Secure Code Injection VulnerabilityKEV since 2022 · listed over a year | 75 | 7.2 | 32.2% · 98.3rd | 2022-03-07 | 2022-09-07KEV since 2022 · listed over a year |
| 817 | CVE-2017-5070Google — Google Chromium V8 Type Confusion VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 32.1% · 98.3rd | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 818 | CVE-2025-43300Apple — Apple iOS, iPadOS, and macOS Out-of-Bounds Write VulnerabilityKEV since 2025 · listed over a year | 75 | 10.0 | 32.0% · 98.3rd | 2025-08-21 | 2025-09-11KEV since 2025 · listed over a year |
| 819 | CVE-2022-4135Google — Google Chromium GPU Heap Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 75 | 9.6 | 31.9% · 98.3rd | 2022-11-28 | 2022-12-19KEV since 2022 · listed over a year |
| 820 | CVE-2026-0300Palo Alto Networks — Palo Alto Networks PAN-OS Out-of-bounds Write VulnerabilityCISA federal deadline · Overdue by 6 months | 75 | 9.3 | 31.7% · 98.3rd | 2026-05-06 | 2026-05-09CISA federal deadline · Overdue by 6 months |
| 821 | CVE-2026-20133Cisco — Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCISA federal deadline · Overdue by 6 months | 75 | 7.5 | 31.5% · 98.3rd | 2026-04-20 | 2026-04-23CISA federal deadline · Overdue by 6 months |
| 822 | CVE-2024-11182MDaemon — MDaemon Email Server Cross-Site Scripting (XSS) VulnerabilityKEV since 2025 · listed over a year | 75 | 5.3 | 31.4% · 98.3rd | 2025-05-19 | 2025-06-09KEV since 2025 · listed over a year |
| 823 | CVE-2016-4523Trihedral — Trihedral VTScada (formerly VTS) Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 7.5 | 31.2% · 98.3rd | 2022-04-15 | 2022-05-06KEV since 2022 · listed over a year |
| 824 | CVE-2025-0994Trimble — Trimble Cityworks Deserialization VulnerabilityKEV since 2025 · listed over a year | 75 | 8.6 | 31.1% · 98.3rd | 2025-02-07 | 2025-02-28KEV since 2025 · listed over a year |
| 825 | CVE-2025-32756Fortinet — Fortinet Multiple Products Stack-Based Buffer Overflow VulnerabilityKEV since 2025 · listed over a year | 75 | 9.8 | 30.9% · 98.3rd | 2025-05-14 | 2025-06-04KEV since 2025 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.