Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 426 | CVE-2020-12812Fortinet — Fortinet FortiOS SSL VPN Improper Authentication VulnerabilityKEV since 2021 · listed over a year | 85 | 9.8 | 45.4% · 98.8th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 427 | CVE-2026-20131Cisco — Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management Deserialization of Untrusted Data VulnerabilityCISA federal deadline · Overdue by 7 months | 85 | 10.0 | 43.2% · 98.7th | 2026-03-19 | 2026-03-22CISA federal deadline · Overdue by 7 months |
| 428 | CVE-2020-12271Sophos — Sophos SFOS SQL Injection VulnerabilityKEV since 2021 · listed over a year | 85 | 9.8 | 42.4% · 98.7th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 429 | CVE-2021-20016SonicWall — SonicWall SSLVPN SMA100 SQL Injection VulnerabilityKEV since 2021 · listed over a year | 85 | 9.8 | 40.0% · 98.6th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 430 | CVE-2022-31199Netwrix — Netwrix Auditor Insecure Object Deserialization VulnerabilityKEV since 2023 · listed over a year | 85 | 9.8 | 36.0% · 98.5th | 2023-07-11 | 2023-08-01KEV since 2023 · listed over a year |
| 431 | CVE-2018-19949QNAP — QNAP NAS File Station Command Injection VulnerabilityKEV since 2022 · listed over a year | 85 | 9.8 | 30.2% · 98.2nd | 2022-05-24 | 2022-06-14KEV since 2022 · listed over a year |
| 432 | CVE-2021-20028SonicWall — SonicWall Secure Remote Access (SRA) SQL Injection VulnerabilityKEV since 2022 · listed over a year | 85 | 9.8 | 30.1% · 98.2nd | 2022-03-28 | 2022-04-18KEV since 2022 · listed over a year |
| 433 | CVE-2018-20753Kaseya — Kaseya VSA Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 85 | 9.8 | 29.6% · 98.2nd | 2022-04-13 | 2022-05-04KEV since 2022 · listed over a year |
| 434 | CVE-2020-5135SonicWall — SonicWall SonicOS Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 85 | 9.8 | 26.9% · 98th | 2022-03-15 | 2022-04-05KEV since 2022 · listed over a year |
| 435 | CVE-2025-14733WatchGuard — WatchGuard Firebox Out of Bounds Write VulnerabilityCISA federal deadline · Overdue by 10 months | 85 | 9.3 | 26.5% · 98th | 2025-12-19 | 2025-12-26CISA federal deadline · Overdue by 10 months |
| 436 | CVE-2023-20269Cisco — Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access VulnerabilityKEV since 2023 · listed over a year | 85 | 9.1 | 25.5% · 97.9th | 2023-09-13 | 2023-10-04KEV since 2023 · listed over a year |
| 437 | CVE-2025-23006SonicWall — SonicWall SMA1000 Appliances Deserialization VulnerabilityKEV since 2025 · listed over a year | 85 | 9.8 | 23.4% · 97.8th | 2025-01-24 | 2025-02-14KEV since 2025 · listed over a year |
| 438 | CVE-2024-9680Mozilla — Mozilla Firefox Use-After-Free VulnerabilityKEV since 2024 · listed over a year | 85 | 9.8 | 23.2% · 97.8th | 2024-10-15 | 2024-11-05KEV since 2024 · listed over a year |
| 439 | CVE-2016-1019Adobe — Adobe Flash Player Arbitrary Code Execution VulnerabilityKEV since 2022 · listed over a year | 85 | 9.8 | 22.3% · 97.7th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 440 | CVE-2024-40766SonicWall — SonicWall SonicOS Improper Access Control VulnerabilityKEV since 2024 · listed over a year | 85 | 9.8 | 18.4% · 97.2nd | 2024-09-09 | 2024-09-30KEV since 2024 · listed over a year |
| 441 | CVE-2019-7193QNAP — QNAP QTS Improper Input Validation VulnerabilityKEV since 2022 · listed over a year | 85 | 9.8 | 14.4% · 96.6th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 442 | CVE-2025-42999SAP — SAP NetWeaver Deserialization VulnerabilityKEV since 2025 · listed over a year | 85 | 9.1 | 12.9% · 96.3rd | 2025-05-15 | 2025-06-05KEV since 2025 · listed over a year |
| 443 | CVE-2021-27103Accellion — Accellion FTA Server-Side Request Forgery (SSRF) VulnerabilityKEV since 2021 · listed over a year | 85 | 9.8 | 11.4% · 96th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 444 | CVE-2018-19323GIGABYTE — GIGABYTE Multiple Products Privilege Escalation VulnerabilityKEV since 2022 · listed over a year | 85 | 9.8 | 8.4% · 95th | 2022-10-24 | 2022-11-14KEV since 2022 · listed over a year |
| 445 | CVE-2019-11634Citrix — Citrix Workspace Application and Receiver for Windows Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 85 | 9.8 | 8.1% · 94.8th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 446 | CVE-2012-1710Oracle — Oracle Fusion Middleware Unspecified VulnerabilityKEV since 2022 · listed over a year | 85 | 9.8 | 7.8% · 94.7th | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 447 | CVE-2026-15409SonicWall — SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilityCISA federal deadline · Overdue by 3 months | 85 | 10.0 | 6.8% · 94th | 2026-07-14 | 2026-07-17CISA federal deadline · Overdue by 3 months |
| 448 | CVE-2021-27101Accellion — Accellion FTA SQL Injection VulnerabilityKEV since 2021 · listed over a year | 85 | 9.8 | 6.0% · 93.3rd | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 449 | CVE-2020-29574Sophos — CyberoamOS (CROS) SQL Injection VulnerabilityKEV since 2025 · listed over a year | 85 | 9.8 | 4.7% · 91.8th | 2025-02-06 | 2025-02-27KEV since 2025 · listed over a year |
| 450 | CVE-2020-2021Palo Alto Networks — Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityKEV since 2022 · listed over a year | 85 | 10.0 | 4.4% · 91.2nd | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.