Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 1151 | CVE-2024-20953Oracle — Oracle Agile Product Lifecycle Management (PLM) Deserialization VulnerabilityKEV since 2025 · listed over a year | 75 | 8.8 | 3.9% · 90.3rd | 2025-02-24 | 2025-03-17KEV since 2025 · listed over a year |
| 1152 | CVE-2025-24201Apple — Apple Multiple Products WebKit Out-of-Bounds Write VulnerabilityKEV since 2025 · listed over a year | 75 | 10.0 | 3.8% · 90.1st | 2025-03-13 | 2025-04-03KEV since 2025 · listed over a year |
| 1153 | CVE-2024-9537ScienceLogic — ScienceLogic SL1 Unspecified VulnerabilityKEV since 2024 · listed over a year | 75 | 9.3 | 3.8% · 90th | 2024-10-21 | 2024-11-11KEV since 2024 · listed over a year |
| 1154 | CVE-2024-0519Google — Google Chromium V8 Out-of-Bounds Memory Access VulnerabilityKEV since 2024 · listed over a year | 75 | 8.8 | 3.8% · 90th | 2024-01-17 | 2024-02-07KEV since 2024 · listed over a year |
| 1155 | CVE-2025-25249Fortinet — Fortinet Multiple Products Heap-based Buffer Overflow VulnerabilityCISA federal deadline · Overdue by 41 days | 75 | 9.8 | 3.8% · 90th | 2026-09-09 | 2026-09-12CISA federal deadline · Overdue by 41 days |
| 1156 | CVE-2021-30665Apple — Apple Multiple Products WebKit Memory Corruption VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 3.7% · 89.7th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1157 | CVE-2020-3566Cisco — Cisco IOS XR Software DVMRP Memory Exhaustion VulnerabilityKEV since 2021 · listed over a year | 75 | 8.6 | 3.7% · 89.7th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1158 | CVE-2018-19321GIGABYTE — GIGABYTE Multiple Products Privilege Escalation VulnerabilityRansomwareKEV since 2022 · listed over a year | 75 | 7.8 | 3.7% · 89.7th | 2022-10-24 | 2022-11-14KEV since 2022 · listed over a year |
| 1159 | CVE-2016-3643SolarWinds — SolarWinds Virtualization Manager Privilege Escalation VulnerabilityKEV since 2021 · listed over a year | 75 | 7.8 | 3.7% · 89.6th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1160 | CVE-2021-31010Apple — Apple iOS, macOS, watchOS Sandbox Bypass VulnerabilityKEV since 2022 · listed over a year | 75 | 7.5 | 3.7% · 89.6th | 2022-08-25 | 2022-09-15KEV since 2022 · listed over a year |
| 1161 | CVE-2023-0266Linux — Linux Kernel Use-After-Free VulnerabilityKEV since 2023 · listed over a year | 75 | 7.0 | 3.7% · 89.6th | 2023-03-30 | 2023-04-20KEV since 2023 · listed over a year |
| 1162 | CVE-2021-27102Accellion — Accellion FTA OS Command Injection VulnerabilityRansomwareKEV since 2021 · listed over a year | 75 | 7.8 | 3.7% · 89.6th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1163 | CVE-2016-8562Siemens — Siemens SIMATIC CP 1543-1 Improper Privilege Management VulnerabilityKEV since 2022 · listed over a year | 75 | 7.5 | 3.6% · 89.4th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 1164 | CVE-2023-22894Strapi — Strapi Cleartext Storage of Sensitive Information VulnerabilityCISA federal deadline · Overdue by 12 days | 75 | 4.9 | 3.6% · 89.4th | 2026-10-08 | 2026-10-11CISA federal deadline · Overdue by 12 days |
| 1165 | CVE-2018-19320GIGABYTE — GIGABYTE Multiple Products Unspecified VulnerabilityRansomwareKEV since 2022 · listed over a year | 75 | 7.8 | 3.6% · 89.4th | 2022-10-24 | 2022-11-14KEV since 2022 · listed over a year |
| 1166 | CVE-2025-3935ConnectWise — ConnectWise ScreenConnect Improper Authentication VulnerabilityKEV since 2025 · listed over a year | 75 | 7.2 | 3.5% · 89.2nd | 2025-06-02 | 2025-06-23KEV since 2025 · listed over a year |
| 1167 | CVE-2021-30663Apple — Apple Multiple Products WebKit Integer Overflow VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 3.5% · 89.2nd | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1168 | CVE-2024-8068Citrix — Citrix Session Recording Improper Privilege Management VulnerabilityKEV since 2025 · listed over a year | 75 | 5.1 | 3.5% · 89th | 2025-08-25 | 2025-09-15KEV since 2025 · listed over a year |
| 1169 | CVE-2018-0175Cisco — Cisco IOS, XR, and XE Software Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 75 | 8.0 | 3.5% · 89th | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 1170 | CVE-2021-35247SolarWinds — SolarWinds Serv-U Improper Input Validation VulnerabilityKEV since 2022 · listed over a year | 75 | 5.3 | 3.5% · 89th | 2022-01-21 | 2022-02-04KEV since 2022 · listed over a year |
| 1171 | CVE-2025-8876N-able — N-able N-Central Command Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 9.4 | 3.4% · 88.9th | 2025-08-13 | 2025-08-20KEV since 2025 · listed over a year |
| 1172 | CVE-2026-31431Linux — Linux Kernel Incorrect Resource Transfer Between Spheres VulnerabilityCISA federal deadline · Overdue by 5 months | 75 | 7.8 | 3.4% · 88.9th | 2026-05-01 | 2026-05-15CISA federal deadline · Overdue by 5 months |
| 1173 | CVE-2025-66644Array Networks — Array Networks ArrayOS AG OS Command Injection VulnerabilityCISA federal deadline · Overdue by 10 months | 75 | 9.8 | 3.4% · 88.8th | 2025-12-08 | 2025-12-29CISA federal deadline · Overdue by 10 months |
| 1174 | CVE-2024-53104Linux — Linux Kernel Out-of-Bounds Write VulnerabilityKEV since 2025 · listed over a year | 75 | 7.8 | 3.4% · 88.8th | 2025-02-05 | 2025-02-26KEV since 2025 · listed over a year |
| 1175 | CVE-2025-42599Qualitia — Qualitia Active! Mail Stack-Based Buffer Overflow VulnerabilityKEV since 2025 · listed over a year | 75 | 9.8 | 3.4% · 88.6th | 2025-04-28 | 2025-05-19KEV since 2025 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.