Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 1226 | CVE-2026-104286Fortinet — Fortinet FortiMail Path Traversal VulnerabilityCISA federal deadline · Overdue by 18 days | 75 | 9.8 | 2.2% · 82.4th | 2026-10-01 | 2026-10-04CISA federal deadline · Overdue by 18 days |
| 1227 | CVE-2026-34621Adobe — Adobe Acrobat and Reader Prototype Pollution VulnerabilityCISA federal deadline · Overdue by 6 months | 75 | 8.6 | 2.2% · 82.2nd | 2026-04-13 | 2026-04-27CISA federal deadline · Overdue by 6 months |
| 1228 | CVE-2020-9819Apple — Apple iOS, iPadOS, and watchOS Memory Corruption VulnerabilityKEV since 2021 · listed over a year | 75 | 4.3 | 2.2% · 82.2nd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1229 | CVE-2017-12232Cisco — Cisco IOS Software for Cisco Integrated Services Routers Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 6.5 | 2.2% · 82nd | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 1230 | CVE-2017-6663Cisco — Cisco IOS Software and Cisco IOS XE Software Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 6.5 | 2.1% · 81.7th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 1231 | CVE-2026-49869Kestra — Kestra OSS OS Command Injection VulnerabilityCISA federal deadline · Overdue by 47 days | 75 | 10.0 | 2.1% · 81.5th | 2026-09-02 | 2026-09-05CISA federal deadline · Overdue by 47 days |
| 1232 | CVE-2023-6448Unitronics — Unitronics Vision PLC and HMI Insecure Default Password VulnerabilityKEV since 2023 · listed over a year | 75 | 9.8 | 2.1% · 81.5th | 2023-12-11 | 2023-12-18KEV since 2023 · listed over a year |
| 1233 | CVE-2026-45247Mirasvit — Mirasvit Full Page Cache Warmer Deserialization of Untrusted Data VulnerabilityCISA federal deadline · Overdue by 5 months | 75 | 9.3 | 2.1% · 81.4th | 2026-06-03 | 2026-06-06CISA federal deadline · Overdue by 5 months |
| 1234 | CVE-2017-12238Cisco — Cisco Catalyst 6800 Series Switches VPLS Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 6.5 | 2.0% · 80.8th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 1235 | CVE-2025-0111Palo Alto Networks — Palo Alto Networks PAN-OS File Read VulnerabilityKEV since 2025 · listed over a year | 75 | 7.1 | 2.0% · 80.6th | 2025-02-20 | 2025-03-13KEV since 2025 · listed over a year |
| 1236 | CVE-2020-2506QNAP Systems — QNAP Helpdesk Improper Access Control VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 2.0% · 80.4th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 1237 | CVE-2023-41974Apple — Apple iOS and iPadOS Use-After-Free VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 7.8 | 2.0% · 80.1st | 2026-03-05 | 2026-03-26CISA federal deadline · Overdue by 7 months |
| 1238 | CVE-2025-8875N-able — N-able N-Central Insecure Deserialization VulnerabilityKEV since 2025 · listed over a year | 75 | 9.4 | 1.9% · 79.5th | 2025-08-13 | 2025-08-20KEV since 2025 · listed over a year |
| 1239 | CVE-2025-27920Srimax — Srimax Output Messenger Directory Traversal VulnerabilityKEV since 2025 · listed over a year | 75 | 8.8 | 1.9% · 79.1st | 2025-05-19 | 2025-06-09KEV since 2025 · listed over a year |
| 1240 | CVE-2025-59689Libraesva — Libraesva Email Security Gateway Command Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 6.1 | 1.9% · 79.1st | 2025-09-29 | 2025-10-20KEV since 2025 · listed over a year |
| 1241 | CVE-2026-76504Cisco — Cisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityCISA federal deadline · Overdue by 19 days | 75 | 9.8 | 1.8% · 78.6th | 2026-09-30 | 2026-10-03CISA federal deadline · Overdue by 19 days |
| 1242 | CVE-2018-19322GIGABYTE — GIGABYTE Multiple Products Code Execution VulnerabilityRansomwareKEV since 2022 · listed over a year | 75 | 7.8 | 1.8% · 78.5th | 2022-10-24 | 2022-11-14KEV since 2022 · listed over a year |
| 1243 | CVE-2026-34909Ubiquiti — Ubiquiti UniFi OS Path Traversal VulnerabilityCISA federal deadline · Overdue by 4 months | 75 | 10.0 | 1.8% · 78.2nd | 2026-06-23 | 2026-06-26CISA federal deadline · Overdue by 4 months |
| 1244 | CVE-2024-7694TeamT5 — TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 7.2 | 1.8% · 78.2nd | 2026-02-17 | 2026-03-10CISA federal deadline · Overdue by 7 months |
| 1245 | CVE-2025-15556Notepad++ — Notepad++ Download of Code Without Integrity Check VulnerabilityCISA federal deadline · Overdue by 8 months | 75 | 7.7 | 1.8% · 78th | 2026-02-12 | 2026-03-05CISA federal deadline · Overdue by 8 months |
| 1246 | CVE-2025-22226VMware — VMware ESXi, Workstation, and Fusion Information Disclosure VulnerabilityKEV since 2025 · listed over a year | 75 | 6.0 | 1.8% · 78th | 2025-03-04 | 2025-03-25KEV since 2025 · listed over a year |
| 1247 | CVE-2026-33634Aquasecurity — Aquasecurity Trivy Embedded Malicious Code VulnerabilityCISA federal deadline · Overdue by 6 months | 75 | 9.4 | 1.7% · 77.7th | 2026-03-26 | 2026-04-09CISA federal deadline · Overdue by 6 months |
| 1248 | CVE-2025-21590Juniper — Juniper Junos OS Improper Isolation or Compartmentalization VulnerabilityKEV since 2025 · listed over a year | 75 | 6.7 | 1.7% · 77.5th | 2025-03-13 | 2025-04-03KEV since 2025 · listed over a year |
| 1249 | CVE-2024-21287Oracle — Oracle Agile Product Lifecycle Management (PLM) Incorrect Authorization VulnerabilityKEV since 2024 · listed over a year | 75 | 7.5 | 1.7% · 77.3rd | 2024-11-21 | 2024-12-12KEV since 2024 · listed over a year |
| 1250 | CVE-2026-65400Apple — Apple macOS Improper Authentication VulnerabilityCISA federal deadline · Overdue by 2 months | 75 | 9.8 | 1.7% · 77.3rd | 2026-08-18 | 2026-08-21CISA federal deadline · Overdue by 2 months |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.