Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,366 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 851 | CVE-2024-4978Justice AV Solutions — Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code VulnerabilityKEV since 2024 · listed over a year | 75 | 8.7 | 26.9% · 98th | 2024-05-29 | 2024-06-19KEV since 2024 · listed over a year |
| 852 | CVE-2025-68461Roundcube — RoundCube Webmail Cross-site Scripting VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 6.1 | 26.8% · 98th | 2026-02-20 | 2026-03-13CISA federal deadline · Overdue by 7 months |
| 853 | CVE-2024-37085VMware — VMware ESXi Authentication Bypass VulnerabilityRansomwareKEV since 2024 · listed over a year | 75 | 7.2 | 26.8% · 98th | 2024-07-30 | 2024-08-20KEV since 2024 · listed over a year |
| 854 | CVE-2020-8196Citrix — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Information Disclosure VulnerabilityKEV since 2021 · listed over a year | 75 | 4.3 | 26.3% · 98th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 855 | CVE-2026-104935Ivanti — Ivanti Connect Secure Authentication Bypass by Spoofing VulnerabilityCISA federal deadline · Overdue by 8 days | 75 | 8.6 | 26.0% · 98th | 2026-10-13 | 2026-10-16CISA federal deadline · Overdue by 8 days |
| 856 | CVE-2026-20122Cisco — Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs VulnerabilityCISA federal deadline · Overdue by 6 months | 75 | 5.4 | 25.8% · 98th | 2026-04-20 | 2026-04-23CISA federal deadline · Overdue by 6 months |
| 857 | CVE-2021-22506Micro Focus — Micro Focus Access Manager Information Leakage VulnerabilityKEV since 2021 · listed over a year | 75 | 7.5 | 25.7% · 98th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 858 | CVE-2015-2590Oracle — Oracle Java SE and Java SE Embedded Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 25.5% · 98th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 859 | CVE-2026-20245Cisco — Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output VulnerabilityCISA federal deadline · Overdue by 4 months | 75 | 7.8 | 25.3% · 97.9th | 2026-06-09 | 2026-06-23CISA federal deadline · Overdue by 4 months |
| 860 | CVE-2016-7855Adobe — Adobe Flash Player Use-After-Free VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 25.2% · 97.9th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 861 | CVE-2022-0185Linux — Linux Kernel Heap-Based Buffer Overflow VulnerabilityKEV since 2024 · listed over a year | 75 | 8.4 | 25.2% · 97.9th | 2024-08-21 | 2024-09-11KEV since 2024 · listed over a year |
| 862 | CVE-2019-18187Trend Micro — Trend Micro OfficeScan Directory Traversal VulnerabilityKEV since 2021 · listed over a year | 75 | 7.5 | 25.1% · 97.9th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 863 | CVE-2018-5002Adobe — Adobe Flash Player Stack-based Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 25.1% · 97.9th | 2022-05-23 | 2022-06-13KEV since 2022 · listed over a year |
| 864 | CVE-2022-3038Google — Google Chromium Network Service Use-After-Free VulnerabilityKEV since 2023 · listed over a year | 75 | 8.8 | 24.9% · 97.9th | 2023-03-30 | 2023-04-20KEV since 2023 · listed over a year |
| 865 | CVE-2014-0502Adobe — Adobe Flash Player Double Free VulnerablityKEV since 2024 · listed over a year | 75 | 8.8 | 24.8% · 97.9th | 2024-09-17 | 2024-10-08KEV since 2024 · listed over a year |
| 866 | CVE-2026-33017Langflow — Langflow Code Injection VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 9.3 | 24.8% · 97.9th | 2026-03-25 | 2026-04-08CISA federal deadline · Overdue by 7 months |
| 867 | CVE-2022-1096Google — Google Chromium V8 Type Confusion VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 24.7% · 97.9th | 2022-03-28 | 2022-04-18KEV since 2022 · listed over a year |
| 868 | CVE-2024-27443Synacor — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilityKEV since 2025 · listed over a year | 75 | 6.1 | 24.6% · 97.9th | 2025-05-19 | 2025-06-09KEV since 2025 · listed over a year |
| 869 | CVE-2023-41993Apple — Apple Multiple Products WebKit Code Execution VulnerabilityKEV since 2023 · listed over a year | 75 | 8.8 | 24.3% · 97.9th | 2023-09-25 | 2023-10-16KEV since 2023 · listed over a year |
| 870 | CVE-2016-9563SAP — SAP NetWeaver XML External Entity (XXE) VulnerabilityKEV since 2021 · listed over a year | 75 | 6.5 | 24.2% · 97.9th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 871 | CVE-2025-4632Samsung — Samsung MagicINFO 9 Server Path Traversal VulnerabilityKEV since 2025 · listed over a year | 75 | 9.8 | 24.1% · 97.8th | 2025-05-22 | 2025-06-12KEV since 2025 · listed over a year |
| 872 | CVE-2021-21166Google — Google Chromium Race Condition VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 24.0% · 97.8th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 873 | CVE-2026-60004Gitea — Gitea Code Injection VulnerabilityCISA federal deadline · Overdue by 57 days | 75 | 9.8 | 24.0% · 97.8th | 2026-08-25 | 2026-08-28CISA federal deadline · Overdue by 57 days |
| 874 | CVE-2023-32439Apple — Apple Multiple Products WebKit Type Confusion VulnerabilityKEV since 2023 · listed over a year | 75 | 8.8 | 24.0% · 97.8th | 2023-06-23 | 2023-07-14KEV since 2023 · listed over a year |
| 875 | CVE-2021-27878Veritas — Veritas Backup Exec Agent Command Execution VulnerabilityRansomwareKEV since 2023 · listed over a year | 75 | 8.8 | 24.0% · 97.8th | 2023-04-07 | 2023-04-28KEV since 2023 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.