Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 1201 | CVE-2025-40602SonicWall — SonicWall SMA1000 Missing Authorization VulnerabilityCISA federal deadline · Overdue by 10 months | 75 | 6.6 | 2.8% · 86.1st | 2025-12-17 | 2025-12-24CISA federal deadline · Overdue by 10 months |
| 1202 | CVE-2020-16017Google — Google Chrome Use-After-Free VulnerabilityKEV since 2021 · listed over a year | 75 | 9.6 | 2.7% · 86th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1203 | CVE-2022-42948Fortra — Fortra Cobalt Strike User Interface Remote Code Execution VulnerabilityKEV since 2023 · listed over a year | 75 | 9.8 | 2.7% · 85.9th | 2023-03-30 | 2023-04-20KEV since 2023 · listed over a year |
| 1204 | CVE-2024-36971Android — Android Kernel Remote Code Execution VulnerabilityKEV since 2024 · listed over a year | 75 | 7.8 | 2.7% · 85.8th | 2024-08-07 | 2024-08-28KEV since 2024 · listed over a year |
| 1205 | CVE-2023-29492Novi Survey — Novi Survey Insecure Deserialization VulnerabilityKEV since 2023 · listed over a year | 75 | 9.8 | 2.7% · 85.8th | 2023-04-13 | 2023-05-04KEV since 2023 · listed over a year |
| 1206 | CVE-2020-24557Trend Micro — Trend Micro Multiple Products Improper Access Control VulnerabilityKEV since 2021 · listed over a year | 75 | 7.8 | 2.7% · 85.6th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1207 | CVE-2023-35674Android — Android Framework Privilege Escalation VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 2.6% · 85.4th | 2023-09-13 | 2023-10-04KEV since 2023 · listed over a year |
| 1208 | CVE-2019-6223Apple — Apple iOS and macOS Group Facetime VulnerabilityKEV since 2021 · listed over a year | 75 | 7.5 | 2.6% · 85.4th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1209 | CVE-2023-21492Samsung — Samsung Mobile Devices Insertion of Sensitive Information Into Log File VulnerabilityKEV since 2023 · listed over a year | 75 | 4.4 | 2.6% · 84.9th | 2023-05-19 | 2023-06-09KEV since 2023 · listed over a year |
| 1210 | CVE-2022-0028Palo Alto Networks — Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 8.6 | 2.5% · 84.9th | 2022-08-22 | 2022-09-12KEV since 2022 · listed over a year |
| 1211 | CVE-2026-6973Ivanti — Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation VulnerabilityCISA federal deadline · Overdue by 5 months | 75 | 7.2 | 2.5% · 84.8th | 2026-05-07 | 2026-05-10CISA federal deadline · Overdue by 5 months |
| 1212 | CVE-2026-7273Zyxel — Zyxel GS1900 Series Switches Stack-Based Buffer Overflow VulnerabilityCISA federal deadline · Overdue by 29 days | 75 | 8.8 | 2.5% · 84.6th | 2026-09-21 | 2026-09-24CISA federal deadline · Overdue by 29 days |
| 1213 | CVE-2025-32975Quest — Quest KACE Systems Management Appliance (SMA) Improper Authentication VulnerabilityCISA federal deadline · Overdue by 6 months | 75 | 10.0 | 2.5% · 84.5th | 2026-04-20 | 2026-05-04CISA federal deadline · Overdue by 6 months |
| 1214 | CVE-2025-30154reviewdog — reviewdog/action-setup GitHub Action Embedded Malicious Code VulnerabilityKEV since 2025 · listed over a year | 75 | 8.6 | 2.5% · 84.5th | 2025-03-24 | 2025-04-14KEV since 2025 · listed over a year |
| 1215 | CVE-2023-20109Cisco — Cisco IOS and IOS XE Group Encrypted Transport VPN Out-of-Bounds Write VulnerabilityKEV since 2023 · listed over a year | 75 | 6.6 | 2.5% · 84.5th | 2023-10-10 | 2023-10-31KEV since 2023 · listed over a year |
| 1216 | CVE-2025-3928Commvault — Commvault Web Server Unspecified VulnerabilityKEV since 2025 · listed over a year | 75 | 8.7 | 2.5% · 84.5th | 2025-04-28 | 2025-05-19KEV since 2025 · listed over a year |
| 1217 | CVE-2026-11645Google — Google Chromium V8 Out-of-Bounds Read and Write VulnerabilityCISA federal deadline · Overdue by 4 months | 75 | 8.8 | 2.4% · 84.2nd | 2026-06-09 | 2026-06-23CISA federal deadline · Overdue by 4 months |
| 1218 | CVE-2018-4344Apple — Apple Multiple Products Memory Corruption VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 2.4% · 83.7th | 2022-06-27 | 2022-07-18KEV since 2022 · listed over a year |
| 1219 | CVE-2022-26486Mozilla — Mozilla Firefox Use-After-Free VulnerabilityKEV since 2022 · listed over a year | 75 | 9.6 | 2.4% · 83.7th | 2022-03-07 | 2022-03-21KEV since 2022 · listed over a year |
| 1220 | CVE-2026-3909Google — Google Skia Out-of-Bounds Write VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 8.8 | 2.3% · 83.5th | 2026-03-13 | 2026-03-27CISA federal deadline · Overdue by 7 months |
| 1221 | CVE-2025-53521F5 — F5 BIG-IP Stack-Based Buffer Overflow VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 9.3 | 2.3% · 83.1st | 2026-03-27 | 2026-03-30CISA federal deadline · Overdue by 7 months |
| 1222 | CVE-2020-9818Apple — Apple iOS, iPadOS, and watchOS Out-of-Bounds Write VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 2.3% · 83rd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1223 | CVE-2026-94127F5 — F5 BIG-IP APM Heap-based Buffer Overflow VulnerabilityCISA federal deadline · Overdue by 28 days | 75 | 9.3 | 2.2% · 82.6th | 2026-09-22 | 2026-09-25CISA federal deadline · Overdue by 28 days |
| 1224 | CVE-2021-1782Apple — Apple Multiple Products Race Condition VulnerabilityKEV since 2021 · listed over a year | 75 | 7.0 | 2.2% · 82.6th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1225 | CVE-2025-21043Samsung — Samsung Mobile Devices Out-of-Bounds Write VulnerabilityKEV since 2025 · listed over a year | 75 | 9.8 | 2.2% · 82.5th | 2025-10-02 | 2025-10-23KEV since 2025 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.