Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,366 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 1026 | CVE-2026-64849MLflow — MLflow Server-Side Request Forgery VulnerabilityCISA federal deadline · Overdue by 52 days | 75 | 9.3 | 10.0% · 95.6th | 2026-08-19 | 2026-09-02CISA federal deadline · Overdue by 52 days |
| 1027 | CVE-2021-21193Google — Google Chromium Blink Use-After-Free VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 10.0% · 95.6th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1028 | CVE-2022-32893Apple — Apple iOS and macOS Out-of-Bounds Write VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 9.9% · 95.6th | 2022-08-18 | 2022-09-08KEV since 2022 · listed over a year |
| 1029 | CVE-2026-83549SonicWall — SonicWall SMA1000 Appliances OS Command Injection VulnerabilityCISA federal deadline · Overdue by 49 days | 75 | 7.8 | 9.9% · 95.6th | 2026-09-02 | 2026-09-05CISA federal deadline · Overdue by 49 days |
| 1030 | CVE-2015-1130Apple — Apple OS X Authentication Bypass VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 9.9% · 95.6th | 2022-02-10 | 2022-08-10KEV since 2022 · listed over a year |
| 1031 | CVE-2026-42018JFrog — JFrog Artifactory Improper Authentication VulnerabilityCISA federal deadline · Overdue by 29 days | 75 | 7.5 | 9.8% · 95.5th | 2026-09-11 | 2026-09-25CISA federal deadline · Overdue by 29 days |
| 1032 | CVE-2022-20701Cisco — Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 9.7% · 95.5th | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 1033 | CVE-2023-41992Apple — Apple Multiple Products Kernel Privilege Escalation VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 9.5% · 95.4th | 2023-09-25 | 2023-10-16KEV since 2023 · listed over a year |
| 1034 | CVE-2023-23529Apple — Apple Multiple Products WebKit Type Confusion VulnerabilityKEV since 2023 · listed over a year | 75 | 8.8 | 9.4% · 95.4th | 2023-02-14 | 2023-03-07KEV since 2023 · listed over a year |
| 1035 | CVE-2018-0156Cisco — Cisco IOS Software and Cisco IOS XE Software Smart Install Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 7.5 | 9.4% · 95.4th | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 1036 | CVE-2021-21206Google — Google Chromium Blink Use-After-Free VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 9.3% · 95.4th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1037 | CVE-2023-42917Apple — Apple Multiple Products WebKit Memory Corruption VulnerabilityKEV since 2023 · listed over a year | 75 | 8.8 | 9.3% · 95.4th | 2023-12-04 | 2023-12-25KEV since 2023 · listed over a year |
| 1038 | CVE-2025-2783Google — Google Chromium Mojo Sandbox Escape VulnerabilityKEV since 2025 · listed over a year | 75 | 8.3 | 9.2% · 95.4th | 2025-03-27 | 2025-04-17KEV since 2025 · listed over a year |
| 1039 | CVE-2022-20703Cisco — Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 75 | 8.0 | 9.2% · 95.3rd | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 1040 | CVE-2015-2291Intel — Intel Ethernet Diagnostics Driver for Windows Denial-of-Service VulnerabilityRansomwareKEV since 2023 · listed over a year | 75 | 7.8 | 9.0% · 95.3rd | 2023-02-10 | 2023-03-03KEV since 2023 · listed over a year |
| 1041 | CVE-2021-30563Google — Google Chromium V8 Type Confusion VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 9.0% · 95.3rd | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1042 | CVE-2022-0995Linux — Linux Kernel Out-of-Bounds Write VulnerabilityCISA federal deadline · Overdue by 56 days | 75 | 7.8 | 8.9% · 95.2nd | 2026-08-26 | 2026-08-29CISA federal deadline · Overdue by 56 days |
| 1043 | CVE-2025-43529Apple — Apple Multiple Products Use-After-Free WebKit VulnerabilityCISA federal deadline · Overdue by 10 months | 75 | 8.8 | 8.8% · 95.2nd | 2025-12-15 | 2026-01-05CISA federal deadline · Overdue by 10 months |
| 1044 | CVE-2026-42016JFrog — JFrog Artifactory Incorrect Authorization VulnerabilityCISA federal deadline · Overdue by 29 days | 75 | 8.8 | 8.6% · 95.1st | 2026-09-11 | 2026-09-25CISA federal deadline · Overdue by 29 days |
| 1045 | CVE-2025-41244Broadcom — Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions VulnerabilityCISA federal deadline · Overdue by 11 months | 75 | 7.8 | 8.6% · 95.1st | 2025-10-30 | 2025-11-20CISA federal deadline · Overdue by 11 months |
| 1046 | CVE-2022-42856Apple — Apple iOS Type Confusion VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 8.5% · 95th | 2022-12-14 | 2023-01-04KEV since 2022 · listed over a year |
| 1047 | CVE-2018-14558Tenda — Tenda AC7, AC9, and AC10 Routers Command Injection VulnerabilityKEV since 2021 · listed over a year | 75 | 9.8 | 8.5% · 95th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1048 | CVE-2015-3246Red Hat — Red Hat Libuser Race Condition VulnerabilityCISA federal deadline · Overdue by 45 days | 75 | 5.1 | 8.5% · 95th | 2026-08-26 | 2026-09-09CISA federal deadline · Overdue by 45 days |
| 1049 | CVE-2024-4671Google — Google Chromium Visuals Use-After-Free VulnerabilityKEV since 2024 · listed over a year | 75 | 9.6 | 8.3% · 95th | 2024-05-13 | 2024-06-03KEV since 2024 · listed over a year |
| 1050 | CVE-2022-23748Audinate — Dante Discovery Process Control VulnerabilityKEV since 2025 · listed over a year | 75 | 7.8 | 8.3% · 94.9th | 2025-02-06 | 2025-02-27KEV since 2025 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.