Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 76 | CVE-2021-44529Ivanti — Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) Code Injection VulnerabilityExigentKEV since 2024 · listed over a year | 93 | 9.8 | 99.1% · 99.93rd | 2024-03-25 | 2024-04-15KEV since 2024 · listed over a year |
| 77 | CVE-2021-40539Zoho — Zoho ManageEngine ADSelfService Plus Authentication Bypass VulnerabilityExigentKEV since 2021 · listed over a year | 93 | 9.8 | 99.0% · 99.93rd | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 78 | CVE-2023-47246SysAid — SysAid Server Path Traversal VulnerabilityExigentKEV since 2023 · listed over a year | 93 | 9.8 | 98.9% · 99.93rd | 2023-11-13 | 2023-12-04KEV since 2023 · listed over a year |
| 79 | CVE-2013-2465Oracle — Oracle Java SE Unspecified VulnerabilityExigentKEV since 2022 · listed over a year | 93 | 9.8 | 98.8% · 99.93rd | 2022-03-28 | 2022-04-18KEV since 2022 · listed over a year |
| 80 | CVE-2012-4681Oracle — Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution VulnerabilityExigentKEV since 2022 · listed over a year | 93 | 9.8 | 98.5% · 99.92nd | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 81 | CVE-2023-48788Fortinet — Fortinet FortiClient EMS SQL Injection VulnerabilityExigentKEV since 2024 · listed over a year | 93 | 9.8 | 98.4% · 99.92nd | 2024-03-25 | 2024-04-15KEV since 2024 · listed over a year |
| 82 | CVE-2022-21587Oracle — Oracle E-Business Suite Unspecified VulnerabilityExigentKEV since 2023 · listed over a year | 93 | 9.8 | 98.3% · 99.92nd | 2023-02-02 | 2023-02-23KEV since 2023 · listed over a year |
| 83 | CVE-2012-0507Oracle — Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution VulnerabilityExigentKEV since 2022 · listed over a year | 93 | 9.8 | 98.2% · 99.92nd | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 84 | CVE-2019-5544VMware — VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow VulnerabilityExigentKEV since 2021 · listed over a year | 93 | 9.8 | 98.1% · 99.91st | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 85 | CVE-2021-42237Sitecore — Sitecore XP Remote Command Execution VulnerabilityExigentKEV since 2022 · listed over a year | 93 | 9.8 | 97.6% · 99.9th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 86 | CVE-2024-41713Mitel — Mitel MiCollab Path Traversal VulnerabilityExigentKEV since 2025 · listed over a year | 93 | 9.1 | 97.2% · 99.9th | 2025-01-07 | 2025-01-28KEV since 2025 · listed over a year |
| 87 | CVE-2023-38203Adobe — Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityExigentKEV since 2024 · listed over a year | 93 | 9.8 | 97.1% · 99.89th | 2024-01-08 | 2024-01-29KEV since 2024 · listed over a year |
| 88 | CVE-2013-0422Oracle — Oracle JRE Remote Code Execution VulnerabilityExigentKEV since 2022 · listed over a year | 93 | 9.8 | 97.0% · 99.89th | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 89 | CVE-2018-1273VMware Tanzu — VMware Tanzu Spring Data Commons Property Binder VulnerabilityExigentKEV since 2022 · listed over a year | 93 | 9.8 | 97.0% · 99.89th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 90 | CVE-2026-0257Palo Alto Networks — Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityCISA federal deadline · Overdue by 5 months | 93 | 7.8 | 96.9% · 99.89th | 2026-05-29 | 2026-06-01CISA federal deadline · Overdue by 5 months |
| 91 | CVE-2018-6530D-Link — D-Link Multiple Routers OS Command Injection VulnerabilityExigentKEV since 2022 · listed over a year | 93 | 9.8 | 96.7% · 99.89th | 2022-09-08 | 2022-09-29KEV since 2022 · listed over a year |
| 92 | CVE-2023-46747F5 — F5 BIG-IP Configuration Utility Authentication Bypass VulnerabilityExigentKEV since 2023 · listed over a year | 93 | 9.8 | 96.5% · 99.88th | 2023-10-31 | 2023-11-21KEV since 2023 · listed over a year |
| 93 | CVE-2022-41352Synacor — Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload VulnerabilityExigentKEV since 2022 · listed over a year | 93 | 9.8 | 95.5% · 99.87th | 2022-10-20 | 2022-11-10KEV since 2022 · listed over a year |
| 94 | CVE-2024-1708ConnectWise — ConnectWise ScreenConnect Path Traversal VulnerabilityCISA federal deadline · Overdue by 5 months | 93 | 8.4 | 95.4% · 99.87th | 2026-04-28 | 2026-05-12CISA federal deadline · Overdue by 5 months |
| 95 | CVE-2024-53704SonicWall — SonicWall SonicOS SSLVPN Improper Authentication VulnerabilityExigentKEV since 2025 · listed over a year | 93 | 9.8 | 95.3% · 99.87th | 2025-02-18 | 2025-03-11KEV since 2025 · listed over a year |
| 96 | CVE-2024-51378CyberPersons — CyberPanel Incorrect Default Permissions VulnerabilityExigentKEV since 2024 · listed over a year | 93 | 9.8 | 94.7% · 99.86th | 2024-12-04 | 2024-12-25KEV since 2024 · listed over a year |
| 97 | CVE-2024-55591Fortinet — Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityExigentKEV since 2025 · listed over a year | 93 | 9.8 | 94.3% · 99.85th | 2025-01-14 | 2025-01-21KEV since 2025 · listed over a year |
| 98 | CVE-2024-55956Cleo — Cleo Multiple Products Unauthenticated File Upload VulnerabilityExigentKEV since 2024 · listed over a year | 93 | 9.8 | 94.0% · 99.85th | 2024-12-17 | 2025-01-07KEV since 2024 · listed over a year |
| 99 | CVE-2026-24423SmarterTools — SmarterTools SmarterMail Missing Authentication for Critical Function VulnerabilityExigentCISA federal deadline · Overdue by 8 months | 93 | 9.3 | 88.2% · 99.77th | 2026-02-05 | 2026-02-26CISA federal deadline · Overdue by 8 months |
| 100 | CVE-2025-52691SmarterTools — SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type VulnerabilityExigentCISA federal deadline · Overdue by 8 months | 93 | 10.0 | 85.7% · 99.73rd | 2026-01-26 | 2026-02-16CISA federal deadline · Overdue by 8 months |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.