Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 226 | CVE-2024-45519Synacor — Synacor Zimbra Collaboration Suite (ZCS) Command Execution VulnerabilityExigentKEV since 2024 · listed over a year | 87 | 9.8 | 99.9% · 99.97th | 2024-10-03 | 2024-10-24KEV since 2024 · listed over a year |
| 227 | CVE-2015-1427Elastic — Elasticsearch Groovy Scripting Engine Remote Code Execution VulnerabilityExigentKEV since 2022 · listed over a year | 87 | 9.8 | 99.9% · 99.97th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 228 | CVE-2020-7961Liferay — Liferay Portal Deserialization of Untrusted Data VulnerabilityExigentKEV since 2021 · listed over a year | 87 | 9.8 | 99.9% · 99.97th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 229 | CVE-2014-0497Adobe — Adobe Flash Player Integer Underflow VulnerablityExigentKEV since 2024 · listed over a year | 87 | 9.8 | 99.9% · 99.97th | 2024-09-17 | 2024-10-08KEV since 2024 · listed over a year |
| 230 | CVE-2021-35394Realtek — Realtek Jungle SDK Remote Code Execution VulnerabilityExigentKEV since 2021 · listed over a year | 87 | 9.8 | 99.9% · 99.96th | 2021-12-10 | 2021-12-24KEV since 2021 · listed over a year |
| 231 | CVE-2021-44515Zoho — Zoho Desktop Central Authentication Bypass VulnerabilityExigentKEV since 2021 · listed over a year | 87 | 9.8 | 99.9% · 99.96th | 2021-12-10 | 2021-12-24KEV since 2021 · listed over a year |
| 232 | CVE-2021-36260Hikvision — Hikvision Improper Input ValidationExigentKEV since 2022 · listed over a year | 87 | 9.8 | 99.9% · 99.96th | 2022-01-10 | 2022-01-24KEV since 2022 · listed over a year |
| 233 | CVE-2022-35914Teclib — Teclib GLPI Remote Code Execution VulnerabilityExigentKEV since 2023 · listed over a year | 87 | 9.8 | 99.9% · 99.96th | 2023-03-07 | 2023-03-28KEV since 2023 · listed over a year |
| 234 | CVE-2022-46169Cacti — Cacti Command Injection VulnerabilityExigentKEV since 2023 · listed over a year | 87 | 9.8 | 99.8% · 99.96th | 2023-02-16 | 2023-03-09KEV since 2023 · listed over a year |
| 235 | CVE-2021-37415Zoho — Zoho ManageEngine ServiceDesk Authentication Bypass VulnerabilityExigentKEV since 2021 · listed over a year | 87 | 9.8 | 99.8% · 99.96th | 2021-12-01 | 2021-12-15KEV since 2021 · listed over a year |
| 236 | CVE-2024-36401OSGeo — OSGeo GeoServer GeoTools Eval Injection VulnerabilityExigentKEV since 2024 · listed over a year | 87 | 9.8 | 99.8% · 99.96th | 2024-07-15 | 2024-08-05KEV since 2024 · listed over a year |
| 237 | CVE-2015-3113Adobe — Adobe Flash Player Heap-Based Buffer Overflow VulnerabilityExigentKEV since 2022 · listed over a year | 87 | 9.8 | 99.8% · 99.96th | 2022-04-13 | 2022-05-04KEV since 2022 · listed over a year |
| 238 | CVE-2022-1040Sophos — Sophos Firewall Authentication Bypass VulnerabilityExigentKEV since 2022 · listed over a year | 87 | 9.8 | 99.8% · 99.96th | 2022-03-31 | 2022-04-21KEV since 2022 · listed over a year |
| 239 | CVE-2020-13927Apache — Apache Airflow's Experimental API Authentication BypassExigentKEV since 2022 · listed over a year | 87 | 9.8 | 99.8% · 99.96th | 2022-01-18 | 2022-07-18KEV since 2022 · listed over a year |
| 240 | CVE-2020-15505Ivanti — Ivanti MobileIron Multiple Products Remote Code Execution VulnerabilityExigentKEV since 2021 · listed over a year | 87 | 9.8 | 99.7% · 99.95th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 241 | CVE-2019-16759vBulletin — vBulletin PHP Module Remote Code Execution VulnerabilityExigentKEV since 2021 · listed over a year | 87 | 9.8 | 99.7% · 99.95th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 242 | CVE-2021-22054Omnissa — Omnissa Workspace ONE Server-Side Request ForgeryCISA federal deadline · Overdue by 7 months | 87 | 7.5 | 99.7% · 99.95th | 2026-03-09 | 2026-03-23CISA federal deadline · Overdue by 7 months |
| 243 | CVE-2022-22965VMware — Spring Framework JDK 9+ Remote Code Execution VulnerabilityExigentKEV since 2022 · listed over a year | 87 | 9.8 | 99.6% · 99.95th | 2022-04-04 | 2022-04-25KEV since 2022 · listed over a year |
| 244 | CVE-2024-9465Palo Alto Networks — Palo Alto Networks Expedition SQL Injection VulnerabilityExigentKEV since 2024 · listed over a year | 87 | 9.2 | 99.6% · 99.95th | 2024-11-14 | 2024-12-05KEV since 2024 · listed over a year |
| 245 | CVE-2023-20198Cisco — Cisco IOS XE Web UI Privilege Escalation VulnerabilityExigentKEV since 2023 · listed over a year | 87 | 10.0 | 99.6% · 99.95th | 2023-10-16 | 2023-10-20KEV since 2023 · listed over a year |
| 246 | CVE-2014-6278GNU — GNU Bash OS Command Injection VulnerabilityKEV since 2025 · listed over a year | 87 | 8.8 | 99.6% · 99.95th | 2025-10-02 | 2025-10-23KEV since 2025 · listed over a year |
| 247 | CVE-2021-33045Dahua — Dahua IP Camera Authentication Bypass VulnerabilityExigentKEV since 2024 · listed over a year | 87 | 9.8 | 99.6% · 99.95th | 2024-08-21 | 2024-09-11KEV since 2024 · listed over a year |
| 248 | CVE-2020-16846SaltStack — SaltStack Salt Shell Injection VulnerabilityExigentKEV since 2021 · listed over a year | 87 | 9.8 | 99.6% · 99.95th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 249 | CVE-2024-4040CrushFTP — CrushFTP VFS Sandbox Escape VulnerabilityExigentKEV since 2024 · listed over a year | 87 | 10.0 | 99.5% · 99.95th | 2024-04-24 | 2024-05-01KEV since 2024 · listed over a year |
| 250 | CVE-2018-20062ThinkPHP — ThinkPHP "noneCms" Remote Code Execution VulnerabilityExigentKEV since 2021 · listed over a year | 87 | 9.8 | 99.5% · 99.95th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.