Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 351 | CVE-2026-42271BerriAI — BerriAI LiteLLM Command Injection VulnerabilityCISA federal deadline · Overdue by 4 months | 86 | 8.7 | 92.6% · 99.83rd | 2026-06-08 | 2026-06-22CISA federal deadline · Overdue by 4 months |
| 352 | CVE-2022-43939Hitachi Vantara — Hitachi Vantara Pentaho BA Server Authorization Bypass VulnerabilityExigentKEV since 2025 · listed over a year | 86 | 9.8 | 92.3% · 99.83rd | 2025-03-03 | 2025-03-24KEV since 2025 · listed over a year |
| 353 | CVE-2024-11680ProjectSend — ProjectSend Improper Authentication VulnerabilityExigentKEV since 2024 · listed over a year | 86 | 9.8 | 91.8% · 99.82nd | 2024-12-03 | 2024-12-24KEV since 2024 · listed over a year |
| 354 | CVE-2017-3066Adobe — Adobe ColdFusion Deserialization VulnerabilityExigentKEV since 2025 · listed over a year | 86 | 9.8 | 90.6% · 99.8th | 2025-02-24 | 2025-03-17KEV since 2025 · listed over a year |
| 355 | CVE-2026-24858Fortinet — Fortinet Multiple Products Authentication Bypass Using an Alternate Path or Channel VulnerabilityCISA federal deadline · Overdue by 9 months | 86 | 9.8 | 85.8% · 99.73rd | 2026-01-27 | 2026-01-30CISA federal deadline · Overdue by 9 months |
| 356 | CVE-2026-81578PaperCut — PaperCut NG/MF Missing Authentication for Critical Function VulnerabilityCISA federal deadline · Overdue by 39 days | 86 | 8.8 | 85.6% · 99.73rd | 2026-08-31 | 2026-09-14CISA federal deadline · Overdue by 39 days |
| 357 | CVE-2020-7796Synacor — Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery VulnerabilityCISA federal deadline · Overdue by 7 months | 86 | 9.8 | 84.4% · 99.7th | 2026-02-17 | 2026-03-10CISA federal deadline · Overdue by 7 months |
| 358 | CVE-2025-40551SolarWinds — SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilityCISA federal deadline · Overdue by 9 months | 86 | 9.8 | 84.2% · 99.7th | 2026-02-03 | 2026-02-06CISA federal deadline · Overdue by 9 months |
| 359 | CVE-2022-24990TerraMaster — TerraMaster OS Remote Command Execution VulnerabilityRansomwareKEV since 2023 · listed over a year | 86 | 7.5 | 83.2% · 99.68th | 2023-02-10 | 2023-03-03KEV since 2023 · listed over a year |
| 360 | CVE-2018-13382Fortinet — Fortinet FortiOS and FortiProxy Improper AuthorizationRansomwareKEV since 2022 · listed over a year | 86 | 7.5 | 81.7% · 99.64th | 2022-01-10 | 2022-07-10KEV since 2022 · listed over a year |
| 361 | CVE-2023-28461Array Networks — Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function VulnerabilityRansomwareExigentKEV since 2024 · listed over a year | 86 | 9.8 | 68.1% · 99.33rd | 2024-11-25 | 2024-12-16KEV since 2024 · listed over a year |
| 362 | CVE-2018-11776Apache — Apache Struts Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 85 | 8.1 | 100.0% · 99.99th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 363 | CVE-2024-13159Ivanti — Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityKEV since 2025 · listed over a year | 85 | 7.5 | 100.0% · 99.99th | 2025-03-10 | 2025-03-31KEV since 2025 · listed over a year |
| 364 | CVE-2024-45195Apache — Apache OFBiz Forced Browsing VulnerabilityKEV since 2025 · listed over a year | 85 | 7.5 | 100.0% · 99.98th | 2025-02-04 | 2025-02-25KEV since 2025 · listed over a year |
| 365 | CVE-2017-12617Apache — Apache Tomcat Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 85 | 8.1 | 100.0% · 99.98th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 366 | CVE-2025-4427Ivanti — Ivanti Endpoint Manager Mobile (EPMM) Authentication Bypass VulnerabilityKEV since 2025 · listed over a year | 85 | 7.5 | 99.9% · 99.97th | 2025-05-19 | 2025-06-09KEV since 2025 · listed over a year |
| 367 | CVE-2017-9805Apache — Apache Struts Deserialization of Untrusted Data VulnerabilityKEV since 2021 · listed over a year | 85 | 8.1 | 99.4% · 99.94th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 368 | CVE-2020-10199Sonatype — Sonatype Nexus Repository Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 85 | 8.8 | 99.1% · 99.93rd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 369 | CVE-2019-5418Rails — Rails Ruby on Rails Path Traversal VulnerabilityKEV since 2025 · listed over a year | 85 | 7.5 | 98.5% · 99.92nd | 2025-07-07 | 2025-07-28KEV since 2025 · listed over a year |
| 370 | CVE-2021-39144XStream — XStream Remote Code Execution VulnerabilityKEV since 2023 · listed over a year | 85 | 8.5 | 98.1% · 99.91st | 2023-03-10 | 2023-03-31KEV since 2023 · listed over a year |
| 371 | CVE-2016-3714ImageMagick — ImageMagick Improper Input Validation VulnerabilityKEV since 2024 · listed over a year | 85 | 8.4 | 97.5% · 99.9th | 2024-09-09 | 2024-09-30KEV since 2024 · listed over a year |
| 372 | CVE-2019-9082ThinkPHP — ThinkPHP Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 85 | 8.8 | 97.4% · 99.9th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 373 | CVE-2023-26360Adobe — Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityKEV since 2023 · listed over a year | 85 | 8.6 | 97.3% · 99.9th | 2023-03-15 | 2023-04-05KEV since 2023 · listed over a year |
| 374 | CVE-2020-1956Apache — Apache Kylin OS Command Injection VulnerabilityKEV since 2022 · listed over a year | 85 | 8.8 | 97.3% · 99.9th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 375 | CVE-2015-2051D-Link — D-Link DIR-645 Router Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 85 | 8.8 | 97.1% · 99.89th | 2022-02-10 | 2022-08-10KEV since 2022 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.