Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 1251 | CVE-2025-48595Android — Android Framework Integer Overflow VulnerabilityCISA federal deadline · Overdue by 5 months | 75 | 8.4 | 1.7% · 77.2nd | 2026-06-02 | 2026-06-05CISA federal deadline · Overdue by 5 months |
| 1252 | CVE-2025-48700Synacor — Synacor Zimbra Collaboration Suite (ZCS) Cross-site Scripting VulnerabilityCISA federal deadline · Overdue by 6 months | 75 | 6.1 | 1.7% · 77.2nd | 2026-04-20 | 2026-04-23CISA federal deadline · Overdue by 6 months |
| 1253 | CVE-2026-72530TrueConf — TrueConf Server Code Injection VulnerabilityCISA federal deadline · Overdue by 49 days | 75 | 9.5 | 1.7% · 76.8th | 2026-08-20 | 2026-09-03CISA federal deadline · Overdue by 49 days |
| 1254 | CVE-2024-39891Twilio — Twilio Authy Information Disclosure VulnerabilityKEV since 2024 · listed over a year | 75 | 5.3 | 1.7% · 76.6th | 2024-07-23 | 2024-08-13KEV since 2024 · listed over a year |
| 1255 | CVE-2025-31277Apple — Apple Multiple Products Buffer Overflow VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 8.8 | 1.7% · 76.4th | 2026-03-20 | 2026-04-03CISA federal deadline · Overdue by 7 months |
| 1256 | CVE-2020-11261Qualcomm — Qualcomm Multiple Chipsets Improper Input Validation VulnerabilityKEV since 2021 · listed over a year | 75 | 7.8 | 1.6% · 75.7th | 2021-12-01 | 2022-06-01KEV since 2021 · listed over a year |
| 1257 | CVE-2026-76519Cisco — Cisco Secure Email Gateway Relative Path Traversal VulnerabilityCISA federal deadline · Overdue by 5 days | 75 | 9.8 | 1.6% · 75.2nd | 2026-10-14 | 2026-10-17CISA federal deadline · Overdue by 5 days |
| 1258 | CVE-2025-22224VMware — VMware ESXi and Workstation TOCTOU Race Condition VulnerabilityKEV since 2025 · listed over a year | 75 | 8.2 | 1.6% · 75th | 2025-03-04 | 2025-03-25KEV since 2025 · listed over a year |
| 1259 | CVE-2026-67277MikroTik — MikroTik RouterOS Missing Authentication for Critical Function VulnerabilityCISA federal deadline · Overdue by 39 days | 75 | 8.8 | 1.6% · 75th | 2026-09-10 | 2026-09-13CISA federal deadline · Overdue by 39 days |
| 1260 | CVE-2019-8720WebKitGTK — WebKitGTK Memory Corruption VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 1.6% · 75th | 2022-05-23 | 2022-06-13KEV since 2022 · listed over a year |
| 1261 | CVE-2021-1905Qualcomm — Qualcomm Multiple Chipsets Use-After-Free VulnerabilityKEV since 2021 · listed over a year | 75 | 7.8 | 1.5% · 74.8th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1262 | CVE-2013-2597Code Aurora — Code Aurora ACDB Audio Driver Stack-based Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 75 | 8.4 | 1.5% · 74.1st | 2022-09-15 | 2022-10-06KEV since 2022 · listed over a year |
| 1263 | CVE-2021-36742Trend Micro — Trend Micro Multiple Products Improper Input Validation VulnerabilityKEV since 2021 · listed over a year | 75 | 7.8 | 1.5% · 73.8th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1264 | CVE-2024-23225Apple — Apple Multiple Products Memory Corruption VulnerabilityKEV since 2024 · listed over a year | 75 | 7.8 | 1.5% · 73.7th | 2024-03-06 | 2024-03-27KEV since 2024 · listed over a year |
| 1265 | CVE-2023-20963Android — Android Framework Privilege Escalation VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 1.5% · 73.5th | 2023-04-13 | 2023-05-04KEV since 2023 · listed over a year |
| 1266 | CVE-2026-72529TrueConf — TrueConf Server Missing Authentication for Critical Function VulnerabilityCISA federal deadline · Overdue by 2 months | 75 | 9.3 | 1.5% · 73.4th | 2026-08-20 | 2026-08-23CISA federal deadline · Overdue by 2 months |
| 1267 | CVE-2024-23296Apple — Apple Multiple Products Memory Corruption VulnerabilityKEV since 2024 · listed over a year | 75 | 7.8 | 1.4% · 72.5th | 2024-03-06 | 2024-03-27KEV since 2024 · listed over a year |
| 1268 | CVE-2026-20700Apple — Apple Multiple Buffer Overflow VulnerabilityCISA federal deadline · Overdue by 8 months | 75 | 7.8 | 1.4% · 72.1st | 2026-02-12 | 2026-03-05CISA federal deadline · Overdue by 8 months |
| 1269 | CVE-2023-41990Apple — Apple Multiple Products Code Execution VulnerabilityKEV since 2024 · listed over a year | 75 | 7.8 | 1.4% · 72nd | 2024-01-08 | 2024-01-29KEV since 2024 · listed over a year |
| 1270 | CVE-2020-0069MediaTek — Mediatek Multiple Chipsets Insufficient Input Validation VulnerabilityKEV since 2021 · listed over a year | 75 | 7.8 | 1.4% · 71.7th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1271 | CVE-2025-39964Linux — Linux Kernel Race Condition VulnerabilityCISA federal deadline · Overdue by 31 days | 75 | 5.5 | 1.4% · 71.5th | 2026-09-18 | 2026-09-21CISA federal deadline · Overdue by 31 days |
| 1272 | CVE-2024-53150Linux — Linux Kernel Out-of-Bounds Read VulnerabilityKEV since 2025 · listed over a year | 75 | 7.1 | 1.4% · 71.4th | 2025-04-09 | 2025-04-30KEV since 2025 · listed over a year |
| 1273 | CVE-2025-35939Craft CMS — Craft CMS External Control of Assumed-Immutable Web Parameter VulnerabilityKEV since 2025 · listed over a year | 75 | 6.9 | 1.3% · 71.3rd | 2025-06-02 | 2025-06-23KEV since 2025 · listed over a year |
| 1274 | CVE-2025-38352Linux — Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition VulnerabilityKEV since 2025 · listed over a year | 75 | 7.8 | 1.3% · 71.1st | 2025-09-04 | 2025-09-25KEV since 2025 · listed over a year |
| 1275 | CVE-2026-88772Citrix — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCISA federal deadline · Overdue by 22 days | 75 | 9.5 | 1.3% · 70.2nd | 2026-09-27 | 2026-09-30CISA federal deadline · Overdue by 22 days |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.