Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,366 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 951 | CVE-2010-3904Linux — Linux Kernel Improper Input Validation VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 15.9% · 96.9th | 2023-05-12 | 2023-06-02KEV since 2023 · listed over a year |
| 952 | CVE-2026-9082Drupal — Drupal Core SQL Injection VulnerabilityCISA federal deadline · Overdue by 5 months | 75 | 9.8 | 15.7% · 96.9th | 2026-05-22 | 2026-05-27CISA federal deadline · Overdue by 5 months |
| 953 | CVE-2026-34197Apache — Apache ActiveMQ Improper Input Validation VulnerabilityCISA federal deadline · Overdue by 6 months | 75 | 8.8 | 15.5% · 96.8th | 2026-04-16 | 2026-04-30CISA federal deadline · Overdue by 6 months |
| 954 | CVE-2024-4947Google — Google Chromium V8 Type Confusion VulnerabilityKEV since 2024 · listed over a year | 75 | 9.6 | 15.2% · 96.8th | 2024-05-20 | 2024-06-10KEV since 2024 · listed over a year |
| 955 | CVE-2026-34908Ubiquiti — Ubiquiti UniFi OS Improper Access Control VulnerabilityCISA federal deadline · Overdue by 4 months | 75 | 10.0 | 15.2% · 96.8th | 2026-06-23 | 2026-06-26CISA federal deadline · Overdue by 4 months |
| 956 | CVE-2015-0310Adobe — Adobe Flash Player ASLR Bypass VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 15.1% · 96.7th | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 957 | CVE-2022-20708Cisco — Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 75 | 8.0 | 14.9% · 96.7th | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 958 | CVE-2026-56291Balbooa — Balbooa Forms Unrestricted Upload of File with Dangerous Type VulnerabilityCISA federal deadline · Overdue by 3 months | 75 | 10.0 | 14.9% · 96.7th | 2026-07-10 | 2026-07-13CISA federal deadline · Overdue by 3 months |
| 959 | CVE-2020-3837Apple — Apple Multiple Products Memory Corruption VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 14.8% · 96.7th | 2022-06-27 | 2022-07-18KEV since 2022 · listed over a year |
| 960 | CVE-2021-30883Apple — Apple Multiple Products Memory Corruption VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 14.7% · 96.7th | 2022-05-23 | 2022-06-13KEV since 2022 · listed over a year |
| 961 | CVE-2018-14634Linux — Linux Kernel Integer Overflow VulnerabilityCISA federal deadline · Overdue by 8 months | 75 | 7.8 | 14.7% · 96.7th | 2026-01-26 | 2026-02-16CISA federal deadline · Overdue by 8 months |
| 962 | CVE-2020-10181Sumavision — Sumavision EMR Cross-Site Request Forgery (CSRF) VulnerabilityKEV since 2021 · listed over a year | 75 | 9.8 | 14.7% · 96.7th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 963 | CVE-2024-8069Citrix — Citrix Session Recording Deserialization of Untrusted Data VulnerabilityKEV since 2025 · listed over a year | 75 | 5.1 | 14.6% · 96.7th | 2025-08-25 | 2025-09-15KEV since 2025 · listed over a year |
| 964 | CVE-2026-18577N-able — N-able N-central Authentication Bypass Using an Alternate Path or Channel VulnerabilityCISA federal deadline · Overdue by 3 months | 75 | 8.2 | 14.6% · 96.7th | 2026-08-03 | 2026-08-06CISA federal deadline · Overdue by 3 months |
| 965 | CVE-2026-82329JFrog — JFrog Artifactory Improper Authentication VulnerabilityCISA federal deadline · Overdue by 49 days | 75 | 9.8 | 14.4% · 96.6th | 2026-09-02 | 2026-09-05CISA federal deadline · Overdue by 49 days |
| 966 | CVE-2023-28204Apple — Apple Multiple Products WebKit Out-of-Bounds Read VulnerabilityKEV since 2023 · listed over a year | 75 | 6.5 | 14.3% · 96.6th | 2023-05-22 | 2023-06-12KEV since 2023 · listed over a year |
| 967 | CVE-2022-26485Mozilla — Mozilla Firefox Use-After-Free VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 14.3% · 96.6th | 2022-03-07 | 2022-03-21KEV since 2022 · listed over a year |
| 968 | CVE-2018-0151Cisco — Cisco IOS Software and Cisco IOS XE Software Quality of Service Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 14.2% · 96.6th | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 969 | CVE-2021-22900Ivanti — Ivanti Pulse Connect Secure Unrestricted File Upload VulnerabilityKEV since 2021 · listed over a year | 75 | 7.2 | 14.1% · 96.6th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 970 | CVE-2025-6554Google — Google Chromium V8 Type Confusion VulnerabilityKEV since 2025 · listed over a year | 75 | 8.1 | 14.1% · 96.6th | 2025-07-02 | 2025-07-23KEV since 2025 · listed over a year |
| 971 | CVE-2026-76460Cisco — Cisco Identity Services Engine Incorrect Use of Privileged APIs VulnerabilityCISA federal deadline · Overdue by 35 days | 75 | 10.0 | 14.0% · 96.6th | 2026-09-16 | 2026-09-19CISA federal deadline · Overdue by 35 days |
| 972 | CVE-2021-1789Apple — Apple Multiple Products Type Confusion VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 14.0% · 96.5th | 2022-05-04 | 2022-05-25KEV since 2022 · listed over a year |
| 973 | CVE-2022-1364Google — Google Chromium V8 Type Confusion VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 13.9% · 96.5th | 2022-04-15 | 2022-05-06KEV since 2022 · listed over a year |
| 974 | CVE-2025-31201Apple — Apple Multiple Products Arbitrary Read and Write VulnerabilityKEV since 2025 · listed over a year | 75 | 9.8 | 13.9% · 96.5th | 2025-04-17 | 2025-05-08KEV since 2025 · listed over a year |
| 975 | CVE-2019-9875Sitecore — Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityKEV since 2025 · listed over a year | 75 | 8.8 | 13.8% · 96.5th | 2025-03-26 | 2025-04-16KEV since 2025 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.