Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 1076 | CVE-2018-0154Cisco — Cisco IOS Software Integrated Services Module for VPN Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 7.5 | 7.1% · 94.2nd | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 1077 | CVE-2020-6820Mozilla — Mozilla Firefox And Thunderbird Use-After-Free VulnerabilityKEV since 2021 · listed over a year | 75 | 8.1 | 7.1% · 94.2nd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1078 | CVE-2026-48710Kludex — Kludex Starlette HTTP Request/Response Smuggling VulnerabilityCISA federal deadline · Overdue by 37 days | 75 | 6.5 | 7.1% · 94.2nd | 2026-09-02 | 2026-09-16CISA federal deadline · Overdue by 37 days |
| 1079 | CVE-2021-30713Apple — Apple macOS Unspecified VulnerabilityKEV since 2021 · listed over a year | 75 | 7.8 | 7.0% · 94.2nd | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1080 | CVE-2021-1871Apple — Apple iOS, iPadOS, and macOS WebKit Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 75 | 9.8 | 7.0% · 94.1st | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1081 | CVE-2021-30952Apple — Apple Multiple Products Integer Overflow or Wraparound VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 7.8 | 7.0% · 94.1st | 2026-03-05 | 2026-03-26CISA federal deadline · Overdue by 7 months |
| 1082 | CVE-2008-3431Oracle — Oracle VirtualBox Insufficient Input Validation VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 6.9% · 94th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 1083 | CVE-2018-0159Cisco — Cisco IOS and XE Software Internet Key Exchange Version 1 Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 7.5 | 6.9% · 94th | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 1084 | CVE-2022-27518Citrix — Citrix Application Delivery Controller (ADC) and Gateway Authentication Bypass VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 6.9% · 94th | 2022-12-13 | 2023-01-03KEV since 2022 · listed over a year |
| 1085 | CVE-2023-26369Adobe — Adobe Acrobat and Reader Out-of-Bounds Write VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 6.7% · 93.9th | 2023-09-14 | 2023-10-05KEV since 2023 · listed over a year |
| 1086 | CVE-2013-1675Mozilla — Mozilla Firefox Information Disclosure VulnerabilityKEV since 2022 · listed over a year | 75 | 6.5 | 6.7% · 93.9th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 1087 | CVE-2023-7024Google — Google Chromium WebRTC Heap Buffer Overflow VulnerabilityKEV since 2024 · listed over a year | 75 | 8.8 | 6.7% · 93.9th | 2024-01-02 | 2024-01-23KEV since 2024 · listed over a year |
| 1088 | CVE-2019-6693Fortinet — Fortinet FortiOS Use of Hard-Coded Credentials VulnerabilityRansomwareKEV since 2025 · listed over a year | 75 | 6.5 | 6.6% · 93.9th | 2025-06-25 | 2025-07-16KEV since 2025 · listed over a year |
| 1089 | CVE-2021-22600Linux — Linux Kernel Privilege Escalation VulnerabilityKEV since 2022 · listed over a year | 75 | 7.0 | 6.6% · 93.8th | 2022-04-11 | 2022-05-02KEV since 2022 · listed over a year |
| 1090 | CVE-2026-34486Apache — Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityCISA federal deadline · Overdue by 3 months | 75 | 7.5 | 6.6% · 93.8th | 2026-08-04 | 2026-08-07CISA federal deadline · Overdue by 3 months |
| 1091 | CVE-2026-86060MikroTik — MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command VulnerabilityCISA federal deadline · Overdue by 40 days | 75 | 9.2 | 6.4% · 93.7th | 2026-09-10 | 2026-09-13CISA federal deadline · Overdue by 40 days |
| 1092 | CVE-2020-16010Google — Google Chrome for Android UI Heap Buffer Overflow VulnerabilityKEV since 2021 · listed over a year | 75 | 9.6 | 6.4% · 93.6th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1093 | CVE-2012-0767Adobe — Adobe Flash Player Cross-Site Scripting (XSS) VulnerabilityKEV since 2022 · listed over a year | 75 | 6.1 | 6.2% · 93.5th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 1094 | CVE-2020-8468Trend Micro — Trend Micro Multiple Products Content Validation Escape VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 6.2% · 93.5th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1095 | CVE-2017-6627Cisco — Cisco IOS Software and Cisco IOS XE Software UDP Packet Processing Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 7.5 | 6.2% · 93.5th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 1096 | CVE-2022-3075Google — Google Chromium Mojo Insufficient Data Validation VulnerabilityKEV since 2022 · listed over a year | 75 | 9.6 | 5.8% · 93.2nd | 2022-09-08 | 2022-09-29KEV since 2022 · listed over a year |
| 1097 | CVE-2022-26500Veeam — Veeam Backup & Replication Remote Code Execution VulnerabilityRansomwareKEV since 2022 · listed over a year | 75 | 8.8 | 5.8% · 93.1st | 2022-12-13 | 2023-01-03KEV since 2022 · listed over a year |
| 1098 | CVE-2026-105133Ahsay — Ahsay AhsayCBS Improper Authentication VulnerabilityCISA federal deadline · Overdue by 6 days | 75 | 5.5 | 5.8% · 93.1st | 2026-10-14 | 2026-10-17CISA federal deadline · Overdue by 6 days |
| 1099 | CVE-2026-42208BerriAI — BerriAI LiteLLM SQL Injection VulnerabilityCISA federal deadline · Overdue by 5 months | 75 | 9.3 | 5.8% · 93.1st | 2026-05-08 | 2026-05-11CISA federal deadline · Overdue by 5 months |
| 1100 | CVE-2023-2136Google — Google Chrome Skia Integer Overflow VulnerabilityKEV since 2023 · listed over a year | 75 | 9.6 | 5.7% · 93rd | 2023-04-21 | 2023-05-12KEV since 2023 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.