Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 1276 | CVE-2023-4346KNX Association — KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism VulnerabilityCISA federal deadline · Overdue by 3 months | 75 | 7.5 | 1.3% · 70.1st | 2026-07-15 | 2026-07-29CISA federal deadline · Overdue by 3 months |
| 1277 | CVE-2026-21385Qualcomm — Qualcomm Multiple Chipsets Memory Corruption VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 7.8 | 1.3% · 70.1st | 2026-03-03 | 2026-03-24CISA federal deadline · Overdue by 7 months |
| 1278 | CVE-2026-102489Zammad GmbH — Zammad GmbH Zammad Session Fixation VulnerabilityCISA federal deadline · Overdue by 17 days | 75 | 9.4 | 1.3% · 69.3rd | 2026-10-02 | 2026-10-05CISA federal deadline · Overdue by 17 days |
| 1279 | CVE-2026-86950Apple — Apple Multiple Products Out-of-Bounds Write VulnerabilityCISA federal deadline · Overdue by 9 days | 75 | 8.8 | 1.2% · 69th | 2026-09-29 | 2026-10-13CISA federal deadline · Overdue by 9 days |
| 1280 | CVE-2023-26083Arm — Arm Mali GPU Kernel Driver Information Disclosure VulnerabilityKEV since 2023 · listed over a year | 75 | 3.3 | 1.2% · 68.4th | 2023-04-07 | 2023-04-28KEV since 2023 · listed over a year |
| 1281 | CVE-2026-0322Palo Alto Networks — Palo Alto Networks PAN-OS Code Injection VulnerabilityCISA federal deadline · Overdue by 5 days | 75 | 8.6 | 1.2% · 68.3rd | 2026-10-14 | 2026-10-17CISA federal deadline · Overdue by 5 days |
| 1282 | CVE-2025-59374ASUS — ASUS Live Update Embedded Malicious Code VulnerabilityCISA federal deadline · Overdue by 9 months | 75 | 9.3 | 1.2% · 67.9th | 2025-12-17 | 2026-01-07CISA federal deadline · Overdue by 9 months |
| 1283 | CVE-2025-43200Apple — Apple Multiple Products Unspecified VulnerabilityKEV since 2025 · listed over a year | 75 | 4.2 | 1.2% · 67.7th | 2025-06-16 | 2025-07-07KEV since 2025 · listed over a year |
| 1284 | CVE-2026-102764BeyondTrust — BeyondTrust Remote Support Authentication Bypass by Spoofing VulnerabilityCISA federal deadline · Overdue by 3 days | 75 | 9.3 | 1.2% · 67.4th | 2026-10-16 | 2026-10-19CISA federal deadline · Overdue by 3 days |
| 1285 | CVE-2026-106931EG Secure Solutions — EG Secure Solutions SiteGuard Server Edition OS Command Injection VulnerabilityCISA federal deadline in 1 day | 75 | 8.5 | 1.2% · 67.1st | 2026-10-20 | 2026-10-23CISA federal deadline in 1 day |
| 1286 | CVE-2023-36851Juniper — Juniper Junos OS SRX Series Missing Authentication for Critical Function VulnerabilityKEV since 2023 · listed over a year | 75 | 5.3 | 1.1% · 66th | 2023-11-13 | 2023-11-17KEV since 2023 · listed over a year |
| 1287 | CVE-2023-4211Arm — Arm Mali GPU Kernel Driver Use-After-Free VulnerabilityKEV since 2023 · listed over a year | 75 | 5.5 | 1.1% · 65.4th | 2023-10-03 | 2023-10-24KEV since 2023 · listed over a year |
| 1288 | CVE-2022-22674Apple — Apple macOS Out-of-Bounds Read VulnerabilityKEV since 2022 · listed over a year | 75 | 5.5 | 1.1% · 65th | 2022-04-04 | 2022-04-25KEV since 2022 · listed over a year |
| 1289 | CVE-2026-88771Citrix — Citrix NetScaler Improper Input Validation VulnerabilityCISA federal deadline · Overdue by 22 days | 75 | 9.5 | 1.1% · 64.9th | 2026-09-27 | 2026-09-30CISA federal deadline · Overdue by 22 days |
| 1290 | CVE-2025-61624Fortinet — Fortinet Multiple Products Path Traversal VulnerabilityCISA federal deadline · Overdue by 3 days | 75 | 6.5 | 1.1% · 64.8th | 2026-10-16 | 2026-10-19CISA federal deadline · Overdue by 3 days |
| 1291 | CVE-2021-25369Samsung — Samsung Mobile Devices Improper Access Control VulnerabilityKEV since 2022 · listed over a year | 75 | 5.5 | 1.1% · 64.8th | 2022-11-08 | 2022-11-29KEV since 2022 · listed over a year |
| 1292 | CVE-2022-42827Apple — Apple iOS and iPadOS Out-of-Bounds Write VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 1.1% · 64.5th | 2022-10-25 | 2022-11-15KEV since 2022 · listed over a year |
| 1293 | CVE-2026-3910Google — Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 8.8 | 1.1% · 64.5th | 2026-03-13 | 2026-03-27CISA federal deadline · Overdue by 7 months |
| 1294 | CVE-2022-22706Arm — Arm Mali GPU Kernel Driver Unspecified VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 1.1% · 64.3rd | 2023-03-30 | 2023-04-20KEV since 2023 · listed over a year |
| 1295 | CVE-2026-93952Arista — Arista VeloCloud Orchestrator Improper Input Validation VulnerabilityCISA federal deadline · Overdue by 27 days | 75 | 9.5 | 1.1% · 64.3rd | 2026-09-22 | 2026-09-25CISA federal deadline · Overdue by 27 days |
| 1296 | CVE-2021-1048Android — Android Kernel Use-After-Free VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 1.1% · 64.2nd | 2022-05-23 | 2022-06-13KEV since 2022 · listed over a year |
| 1297 | CVE-2026-67279MikroTik — Mikrotik RouterOS Improper Enforcement of Behavioral Workflow VulnerabilityCISA federal deadline · Overdue by 24 days | 75 | 6.9 | 1.0% · 63.9th | 2026-09-25 | 2026-09-28CISA federal deadline · Overdue by 24 days |
| 1298 | CVE-2021-23874McAfee — McAfee Total Protection (MTP) Improper Privilege Management VulnerabilityKEV since 2021 · listed over a year | 75 | 7.8 | 1.0% · 63.3rd | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1299 | CVE-2025-22225VMware — VMware ESXi Arbitrary Write VulnerabilityRansomwareKEV since 2025 · listed over a year | 75 | 8.2 | 1.0% · 63rd | 2025-03-04 | 2025-03-25KEV since 2025 · listed over a year |
| 1300 | CVE-2025-27038Qualcomm — Qualcomm Multiple Chipsets Use-After-Free VulnerabilityKEV since 2025 · listed over a year | 75 | 7.5 | 1.0% · 63rd | 2025-06-03 | 2025-06-24KEV since 2025 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.