Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 401 | CVE-2021-32648October CMS — October CMS Improper AuthenticationExigentKEV since 2022 · listed over a year | 85 | 9.1 | 90.4% · 99.8th | 2022-01-18 | 2022-02-01KEV since 2022 · listed over a year |
| 402 | CVE-2020-3952VMware — VMware vCenter Server Information Disclosure VulnerabilityExigentKEV since 2021 · listed over a year | 85 | 9.8 | 90.4% · 99.8th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 403 | CVE-2016-8735Apache — Apache Tomcat Remote Code Execution VulnerabilityExigentKEV since 2023 · listed over a year | 85 | 9.8 | 90.3% · 99.8th | 2023-05-12 | 2023-06-02KEV since 2023 · listed over a year |
| 404 | CVE-2020-29583Zyxel — Zyxel Multiple Products Use of Hard-Coded Credentials VulnerabilityExigentKEV since 2021 · listed over a year | 85 | 9.8 | 90.2% · 99.8th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 405 | CVE-2013-0431Oracle — Oracle JRE Sandbox Bypass VulnerabilityRansomwareKEV since 2022 · listed over a year | 85 | 5.3 | 90.1% · 99.8th | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 406 | CVE-2025-54253Adobe — Adobe Experience Manager Forms Code Execution VulnerabilityKEV since 2025 · listed over a year | 85 | 10.0 | 88.3% · 99.77th | 2025-10-15 | 2025-11-05KEV since 2025 · listed over a year |
| 407 | CVE-2026-20230Cisco — Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) VulnerabilityCISA federal deadline · Overdue by 4 months | 85 | 8.6 | 88.2% · 99.77th | 2026-06-25 | 2026-06-28CISA federal deadline · Overdue by 4 months |
| 408 | CVE-2024-58136Yiiframework — Yiiframework Yii Improper Protection of Alternate Path VulnerabilityKEV since 2025 · listed over a year | 85 | 9.8 | 87.8% · 99.76th | 2025-05-02 | 2025-05-23KEV since 2025 · listed over a year |
| 409 | CVE-2024-12356BeyondTrust — BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection VulnerabilityKEV since 2024 · listed over a year | 85 | 9.8 | 87.3% · 99.75th | 2024-12-19 | 2024-12-27KEV since 2024 · listed over a year |
| 410 | CVE-2009-3459Adobe — Adobe Acrobat and Reader Heap-Based Buffer Overflow VulnerabilityCISA federal deadline · Overdue by 5 months | 85 | 8.8 | 86.6% · 99.74th | 2026-05-20 | 2026-06-03CISA federal deadline · Overdue by 5 months |
| 411 | CVE-2020-3580Cisco — Cisco ASA and FTD Cross-Site Scripting (XSS) VulnerabilityRansomwareKEV since 2021 · listed over a year | 85 | 6.1 | 85.6% · 99.72nd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 412 | CVE-2023-41266Qlik — Qlik Sense Path Traversal VulnerabilityRansomwareKEV since 2023 · listed over a year | 85 | 6.5 | 84.8% · 99.71st | 2023-12-07 | 2023-12-28KEV since 2023 · listed over a year |
| 413 | CVE-2023-27532Veeam — Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function VulnerabilityRansomwareKEV since 2023 · listed over a year | 85 | 7.5 | 80.6% · 99.63rd | 2023-08-22 | 2023-09-12KEV since 2023 · listed over a year |
| 414 | CVE-2021-21975VMware — VMware Server Side Request Forgery in vRealize Operations Manager APIRansomwareKEV since 2022 · listed over a year | 85 | 7.5 | 78.0% · 99.58th | 2022-01-18 | 2022-02-01KEV since 2022 · listed over a year |
| 415 | CVE-2026-8037Progress — Progress LoadMaster Command Injection VulnerabilityCISA federal deadline · Overdue by 2 months | 85 | 9.8 | 77.4% · 99.56th | 2026-08-07 | 2026-08-10CISA federal deadline · Overdue by 2 months |
| 416 | CVE-2026-93616Check Point — Check Point Multiple Products Path Traversal VulnerabilityCISA federal deadline · Overdue by 28 days | 85 | 9.8 | 75.9% · 99.53rd | 2026-09-22 | 2026-09-25CISA federal deadline · Overdue by 28 days |
| 417 | CVE-2026-21962Oracle — Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control VulnerabilityCISA federal deadline · Overdue by 57 days | 85 | 10.0 | 73.2% · 99.46th | 2026-08-24 | 2026-08-27CISA federal deadline · Overdue by 57 days |
| 418 | CVE-2022-2294WebRTC — WebRTC Heap Buffer Overflow VulnerabilityRansomwareKEV since 2022 · listed over a year | 85 | 8.8 | 70.8% · 99.4th | 2022-08-25 | 2022-09-15KEV since 2022 · listed over a year |
| 419 | CVE-2021-27877Veritas — Veritas Backup Exec Agent Improper Authentication VulnerabilityRansomwareExigentKEV since 2023 · listed over a year | 85 | 9.8 | 64.9% · 99.25th | 2023-04-07 | 2023-04-28KEV since 2023 · listed over a year |
| 420 | CVE-2021-27104Accellion — Accellion FTA OS Command Injection VulnerabilityRansomwareExigentKEV since 2021 · listed over a year | 85 | 9.8 | 56.7% · 99.06th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 421 | CVE-2022-29499Mitel — Mitel MiVoice Connect Data Validation VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 85 | 9.8 | 55.2% · 99.03rd | 2022-06-27 | 2022-07-18KEV since 2022 · listed over a year |
| 422 | CVE-2021-22941Citrix — Citrix ShareFile Improper Access Control VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 85 | 9.8 | 53.6% · 99th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 423 | CVE-2023-48365Qlik — Qlik Sense HTTP Tunneling VulnerabilityRansomwareExigentKEV since 2025 · listed over a year | 85 | 9.9 | 47.5% · 98.8th | 2025-01-13 | 2025-02-03KEV since 2025 · listed over a year |
| 424 | CVE-2021-22893Ivanti — Ivanti Pulse Connect Secure Use-After-Free VulnerabilityRansomwareExigentKEV since 2021 · listed over a year | 85 | 10.0 | 47.2% · 98.8th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 425 | CVE-2026-12569PTC — PTC Windchill and FlexPLM Improper Input Validation VulnerabilityRansomwareExigentCISA federal deadline · Overdue by 4 months | 85 | 9.3 | 46.0% · 98.8th | 2026-06-25 | 2026-06-28CISA federal deadline · Overdue by 4 months |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.