Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 326 | CVE-2019-1003030Jenkins — Jenkins Matrix Project Plugin Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 86 | 9.9 | 97.1% · 99.89th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 327 | CVE-2025-5086Dassault Systèmes — Dassault Systèmes DELMIA Apriso Deserialization of Untrusted Data VulnerabilityKEV since 2025 · listed over a year | 86 | 9.0 | 96.9% · 99.89th | 2025-09-11 | 2025-10-02KEV since 2025 · listed over a year |
| 328 | CVE-2020-25223Sophos — Sophos SG UTM Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 86 | 9.8 | 96.8% · 99.89th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 329 | CVE-2021-22502Micro Focus — Micro Focus Operation Bridge Report (OBR) Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 86 | 9.8 | 96.7% · 99.89th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 330 | CVE-2011-3544Oracle — Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution VulnerabilityKEV since 2022 · listed over a year | 86 | 9.8 | 96.7% · 99.89th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 331 | CVE-2020-11651SaltStack — SaltStack Salt Authentication Bypass VulnerabilityKEV since 2021 · listed over a year | 86 | 9.8 | 96.6% · 99.89th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 332 | CVE-2023-33246Apache — Apache RocketMQ Command Execution VulnerabilityKEV since 2023 · listed over a year | 86 | 9.8 | 96.6% · 99.88th | 2023-09-06 | 2023-09-27KEV since 2023 · listed over a year |
| 333 | CVE-2009-1151phpMyAdmin — phpMyAdmin Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 86 | 9.8 | 96.6% · 99.88th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 334 | CVE-2010-0840Oracle — Oracle JRE Unspecified VulnerabilityKEV since 2022 · listed over a year | 86 | 9.8 | 96.3% · 99.88th | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 335 | CVE-2021-35587Oracle — Oracle Fusion Middleware Unspecified VulnerabilityKEV since 2022 · listed over a year | 86 | 9.8 | 96.3% · 99.88th | 2022-11-28 | 2022-12-19KEV since 2022 · listed over a year |
| 336 | CVE-2022-24112Apache — Apache APISIX Authentication Bypass VulnerabilityKEV since 2022 · listed over a year | 86 | 9.8 | 96.1% · 99.88th | 2022-08-25 | 2022-09-15KEV since 2022 · listed over a year |
| 337 | CVE-2020-17530Apache — Apache Struts Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 86 | 9.8 | 95.9% · 99.88th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 338 | CVE-2020-5847Unraid — Unraid Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 86 | 9.8 | 95.8% · 99.88th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 339 | CVE-2022-23131Zabbix — Zabbix Frontend Authentication Bypass VulnerabilityKEV since 2022 · listed over a year | 86 | 9.8 | 95.7% · 99.87th | 2022-02-22 | 2022-03-08KEV since 2022 · listed over a year |
| 340 | CVE-2019-7609Elastic — Kibana Arbitrary Code ExecutionKEV since 2022 · listed over a year | 86 | 10.0 | 95.3% · 99.87th | 2022-01-10 | 2022-07-10KEV since 2022 · listed over a year |
| 341 | CVE-2015-0313Adobe — Adobe Flash Player Use-After-Free VulnerabilityKEV since 2022 · listed over a year | 86 | 9.8 | 95.3% · 99.87th | 2022-04-13 | 2022-05-04KEV since 2022 · listed over a year |
| 342 | CVE-2019-10068Kentico — Kentico Xperience Deserialization of Untrusted Data VulnerabilityKEV since 2022 · listed over a year | 86 | 9.8 | 95.1% · 99.87th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 343 | CVE-2023-36845Juniper — Juniper Junos OS EX Series and SRX Series PHP External Variable Modification VulnerabilityKEV since 2023 · listed over a year | 86 | 9.8 | 95.1% · 99.87th | 2023-11-13 | 2023-11-17KEV since 2023 · listed over a year |
| 344 | CVE-2015-4852Oracle — Oracle WebLogic Server Deserialization of Untrusted Data VulnerabilityKEV since 2021 · listed over a year | 86 | 9.8 | 95.0% · 99.86th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 345 | CVE-2019-12989Citrix — Citrix SD-WAN and NetScaler SQL Injection VulnerabilityKEV since 2022 · listed over a year | 86 | 9.8 | 94.9% · 99.86th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 346 | CVE-2020-6287SAP — SAP NetWeaver Missing Authentication for Critical Function VulnerabilityKEV since 2021 · listed over a year | 86 | 10.0 | 94.7% · 99.86th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 347 | CVE-2020-14644Oracle — Oracle WebLogic Server Remote Code Execution VulnerabilityKEV since 2024 · listed over a year | 86 | 9.8 | 94.5% · 99.86th | 2024-09-18 | 2024-10-09KEV since 2024 · listed over a year |
| 348 | CVE-2017-18368Zyxel — Zyxel P660HN-T1A Routers Command Injection VulnerabilityKEV since 2023 · listed over a year | 86 | 9.8 | 94.5% · 99.86th | 2023-08-07 | 2023-08-28KEV since 2023 · listed over a year |
| 349 | CVE-2023-7028GitLab — GitLab Community and Enterprise Editions Improper Access Control VulnerabilityKEV since 2024 · listed over a year | 86 | 9.8 | 94.5% · 99.85th | 2024-05-01 | 2024-05-22KEV since 2024 · listed over a year |
| 350 | CVE-2025-54309CrushFTP — CrushFTP Unprotected Alternate Channel VulnerabilityKEV since 2025 · listed over a year | 86 | 9.8 | 93.5% · 99.84th | 2025-07-22 | 2025-08-12KEV since 2025 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.