Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 1351 | CVE-2025-43520Apple — Apple Multiple Products Classic Buffer Overflow VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 5.5 | 0.4% · 35.7th | 2026-03-20 | 2026-04-03CISA federal deadline · Overdue by 7 months |
| 1352 | CVE-2026-96652Plex — Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCISA federal deadline in 12 days | 75 | 5.3 | 0.4% · 35.5th | 2026-10-20 | 2026-11-03CISA federal deadline in 12 days |
| 1353 | CVE-2026-96655Plex — Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityCISA federal deadline in 12 days | 75 | 5.3 | 0.4% · 35.5th | 2026-10-20 | 2026-11-03CISA federal deadline in 12 days |
| 1354 | CVE-2022-22071Qualcomm — Qualcomm Multiple Chipsets Use-After-Free VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 0.4% · 34.1st | 2023-12-05 | 2023-12-26KEV since 2023 · listed over a year |
| 1355 | CVE-2021-25394Samsung — Samsung Mobile Devices Race Condition VulnerabilityKEV since 2023 · listed over a year | 75 | 6.4 | 0.4% · 33.2nd | 2023-06-29 | 2023-07-20KEV since 2023 · listed over a year |
| 1356 | CVE-2022-22265Samsung — Samsung Mobile Devices Use-After-Free VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 0.4% · 31.7th | 2023-09-18 | 2023-10-09KEV since 2023 · listed over a year |
| 1357 | CVE-2021-25395Samsung — Samsung Mobile Devices Race Condition VulnerabilityKEV since 2023 · listed over a year | 75 | 6.4 | 0.4% · 29.3rd | 2023-06-29 | 2023-07-20KEV since 2023 · listed over a year |
| 1358 | CVE-2025-43510Apple — Apple Multiple Products Improper Locking VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 7.8 | 0.4% · 28th | 2026-03-20 | 2026-04-03CISA federal deadline · Overdue by 7 months |
| 1359 | CVE-2026-3502TrueConf — TrueConf Client Download of Code Without Integrity Check VulnerabilityCISA federal deadline · Overdue by 6 months | 75 | 7.8 | 0.3% · 24.7th | 2026-04-02 | 2026-04-16CISA federal deadline · Overdue by 6 months |
| 1360 | CVE-2023-21237Android — Android Pixel Information Disclosure VulnerabilityKEV since 2024 · listed over a year | 75 | 5.5 | 0.3% · 17.5th | 2024-03-05 | 2024-03-26KEV since 2024 · listed over a year |
| 1361 | CVE-2025-48633Android — Android Framework Information Disclosure VulnerabilityCISA federal deadline · Overdue by 10 months | 75 | 5.5 | 0.3% · 17th | 2025-12-02 | 2025-12-23CISA federal deadline · Overdue by 10 months |
| 1362 | CVE-2026-110936Siemens — Siemens Software Center Uncontrolled Search Path Element VulnerabilityCISA federal deadline in 12 days | 75 | 8.4 | 0.3% · 17.1st | 2026-10-20 | 2026-11-03CISA federal deadline in 12 days |
| 1363 | CVE-2025-48572Android — Android Framework Privilege Escalation VulnerabilityCISA federal deadline · Overdue by 10 months | 75 | 7.8 | 0.3% · 16.6th | 2025-12-02 | 2025-12-23CISA federal deadline · Overdue by 10 months |
| 1364 | CVE-2026-87886Acronis — Acronis Backup Incorrect Default Permissions VulnerabilityCISA federal deadline · Overdue by 33 days | 75 | 7.8 | 0.2% · 13.4th | 2026-09-16 | 2026-09-19CISA federal deadline · Overdue by 33 days |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.