Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 251 | CVE-2018-0171Cisco — Cisco IOS and IOS XE Software Smart Install Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 87 | 9.8 | 99.5% · 99.94th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 252 | CVE-2023-34048VMware — VMware vCenter Server Out-of-Bounds Write VulnerabilityKEV since 2024 · listed over a year | 87 | 9.8 | 99.4% · 99.94th | 2024-01-22 | 2024-02-12KEV since 2024 · listed over a year |
| 253 | CVE-2024-38856Apache — Apache OFBiz Incorrect Authorization VulnerabilityKEV since 2024 · listed over a year | 87 | 9.8 | 99.4% · 99.94th | 2024-08-27 | 2024-09-17KEV since 2024 · listed over a year |
| 254 | CVE-2022-0543Redis — Debian-specific Redis Server Lua Sandbox Escape VulnerabilityKEV since 2022 · listed over a year | 87 | 10.0 | 99.4% · 99.94th | 2022-03-28 | 2022-04-18KEV since 2022 · listed over a year |
| 255 | CVE-2014-6287Rejetto — Rejetto HTTP File Server (HFS) Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 99.3% · 99.94th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 256 | CVE-2023-28771Zyxel — Zyxel Multiple Firewalls OS Command Injection VulnerabilityKEV since 2023 · listed over a year | 87 | 9.8 | 99.3% · 99.94th | 2023-05-31 | 2023-06-21KEV since 2023 · listed over a year |
| 257 | CVE-2020-1938Apache — Apache Tomcat Improper Privilege Management VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 99.3% · 99.94th | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 258 | CVE-2020-14750Oracle — Oracle WebLogic Server Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 87 | 9.8 | 99.2% · 99.94th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 259 | CVE-2024-27348Apache — Apache HugeGraph-Server Improper Access Control VulnerabilityKEV since 2024 · listed over a year | 87 | 9.8 | 99.2% · 99.94th | 2024-09-18 | 2024-10-09KEV since 2024 · listed over a year |
| 260 | CVE-2022-24086Adobe — Adobe Commerce and Magento Open Source Improper Input Validation VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 99.2% · 99.94th | 2022-02-15 | 2022-03-01KEV since 2022 · listed over a year |
| 261 | CVE-2020-7247OpenBSD — OpenSMTPD Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 99.0% · 99.93rd | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 262 | CVE-2019-3929Crestron — Crestron Multiple Products Command Injection VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 99.0% · 99.93rd | 2022-04-15 | 2022-05-06KEV since 2022 · listed over a year |
| 263 | CVE-2017-3881Cisco — Cisco IOS and IOS XE Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 99.0% · 99.93rd | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 264 | CVE-2017-9791Apache — Apache Struts 1 Improper Input Validation VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 98.9% · 99.93rd | 2022-02-10 | 2022-08-10KEV since 2022 · listed over a year |
| 265 | CVE-2022-3236Sophos — Sophos Firewall Code Injection VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 98.9% · 99.93rd | 2022-09-23 | 2022-10-14KEV since 2022 · listed over a year |
| 266 | CVE-2015-5119Adobe — Adobe Flash Player Use-After-Free VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 98.6% · 99.92nd | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 267 | CVE-2016-3088Apache — Apache ActiveMQ Improper Input Validation VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 98.5% · 99.92nd | 2022-02-10 | 2022-08-10KEV since 2022 · listed over a year |
| 268 | CVE-2017-15944Palo Alto Networks — Palo Alto Networks PAN-OS Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 98.3% · 99.92nd | 2022-08-18 | 2022-09-08KEV since 2022 · listed over a year |
| 269 | CVE-2018-1000861Jenkins — Jenkins Stapler Web Framework Deserialization of Untrusted Data VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 98.3% · 99.92nd | 2022-02-10 | 2022-08-10KEV since 2022 · listed over a year |
| 270 | CVE-2016-1555NETGEAR — NETGEAR Multiple WAP Devices Command Injection VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 98.3% · 99.92nd | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 271 | CVE-2023-20887VMware — Vmware Aria Operations for Networks Command Injection VulnerabilityKEV since 2023 · listed over a year | 87 | 9.8 | 98.3% · 99.92nd | 2023-06-22 | 2023-07-13KEV since 2023 · listed over a year |
| 272 | CVE-2022-22947VMware — VMware Spring Cloud Gateway Code Injection VulnerabilityKEV since 2022 · listed over a year | 87 | 10.0 | 98.3% · 99.92nd | 2022-05-16 | 2022-06-06KEV since 2022 · listed over a year |
| 273 | CVE-2022-26138Atlassian — Atlassian Questions For Confluence App Hard-coded Credentials VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 98.2% · 99.92nd | 2022-07-29 | 2022-08-19KEV since 2022 · listed over a year |
| 274 | CVE-2020-6207SAP — SAP Solution Manager Missing Authentication for Critical Function VulnerabilityKEV since 2021 · listed over a year | 87 | 9.8 | 98.1% · 99.91st | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 275 | CVE-2024-3272D-Link — D-Link Multiple NAS Devices Use of Hard-Coded Credentials VulnerabilityKEV since 2024 · listed over a year | 87 | 9.8 | 98.1% · 99.91st | 2024-04-11 | 2024-05-02KEV since 2024 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.