Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 26 | CVE-2023-27350PaperCut — PaperCut MF/NG Improper Access Control VulnerabilityKEV since 2023 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2023-04-21 | 2023-05-12KEV since 2023 · listed over a year |
| 27 | CVE-2023-35078Ivanti — Ivanti Endpoint Manager Mobile Authentication Bypass VulnerabilityKEV since 2023 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2023-07-25 | 2023-08-15KEV since 2023 · listed over a year |
| 28 | CVE-2023-35082Ivanti — Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass VulnerabilityKEV since 2024 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2024-01-18 | 2024-02-08KEV since 2024 · listed over a year |
| 29 | CVE-2024-23897Jenkins — Jenkins Command Line Interface (CLI) Path Traversal VulnerabilityKEV since 2024 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2024-08-19 | 2024-09-09KEV since 2024 · listed over a year |
| 30 | CVE-2024-3400Palo Alto Networks — Palo Alto Networks PAN-OS Command Injection VulnerabilityKEV since 2024 · listed over a year | 94 | 10.0 | 100.0% · 99.99th | 2024-04-12 | 2024-04-19KEV since 2024 · listed over a year |
| 31 | CVE-2022-22954VMware — VMware Workspace ONE Access and Identity Manager Server-Side Template Injection VulnerabilityKEV since 2022 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2022-04-14 | 2022-05-05KEV since 2022 · listed over a year |
| 32 | CVE-2021-41773Apache — Apache HTTP Server Path Traversal VulnerabilityKEV since 2021 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 33 | CVE-2018-7600Drupal — Drupal Core Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 34 | CVE-2023-29300Adobe — Adobe ColdFusion Deserialization of Untrusted Data VulnerabilityKEV since 2024 · listed over a year | 94 | 9.8 | 100.0% · 99.99th | 2024-01-08 | 2024-01-29KEV since 2024 · listed over a year |
| 35 | CVE-2023-42793JetBrains — JetBrains TeamCity Authentication Bypass VulnerabilityKEV since 2023 · listed over a year | 94 | 9.8 | 100.0% · 99.98th | 2023-10-04 | 2023-10-25KEV since 2023 · listed over a year |
| 36 | CVE-2024-4577PHP Group — PHP-CGI OS Command Injection VulnerabilityKEV since 2024 · listed over a year | 94 | 9.8 | 100.0% · 99.98th | 2024-06-12 | 2024-07-03KEV since 2024 · listed over a year |
| 37 | CVE-2022-40684Fortinet — Fortinet Multiple Products Authentication Bypass VulnerabilityKEV since 2022 · listed over a year | 94 | 9.8 | 100.0% · 99.98th | 2022-10-11 | 2022-11-01KEV since 2022 · listed over a year |
| 38 | CVE-2023-22527Atlassian — Atlassian Confluence Data Center and Server Template Injection VulnerabilityKEV since 2024 · listed over a year | 94 | 9.8 | 100.0% · 99.98th | 2024-01-24 | 2024-02-14KEV since 2024 · listed over a year |
| 39 | CVE-2025-0282Ivanti — Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityKEV since 2025 · listed over a year | 94 | 9.0 | 100.0% · 99.98th | 2025-01-08 | 2025-01-15KEV since 2025 · listed over a year |
| 40 | CVE-2024-1709ConnectWise — ConnectWise ScreenConnect Authentication Bypass VulnerabilityKEV since 2024 · listed over a year | 94 | 10.0 | 100.0% · 99.98th | 2024-02-22 | 2024-02-29KEV since 2024 · listed over a year |
| 41 | CVE-2019-2725Oracle — Oracle WebLogic Server, InjectionKEV since 2022 · listed over a year | 94 | 9.8 | 100.0% · 99.98th | 2022-01-10 | 2022-07-10KEV since 2022 · listed over a year |
| 42 | CVE-2025-5777Citrix — Citrix NetScaler ADC and Gateway Out-of-Bounds Read VulnerabilityKEV since 2025 · listed over a year | 94 | 9.3 | 100.0% · 99.98th | 2025-07-10 | 2025-07-11KEV since 2025 · listed over a year |
| 43 | CVE-2022-47986IBM — IBM Aspera Faspex Code Execution VulnerabilityKEV since 2023 · listed over a year | 94 | 9.8 | 100.0% · 99.98th | 2023-02-21 | 2023-03-14KEV since 2023 · listed over a year |
| 44 | CVE-2021-42013Apache — Apache HTTP Server Path Traversal VulnerabilityKEV since 2021 · listed over a year | 94 | 9.8 | 100.0% · 99.98th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 45 | CVE-2022-1388F5 — F5 BIG-IP Missing Authentication VulnerabilityKEV since 2022 · listed over a year | 94 | 9.8 | 100.0% · 99.98th | 2022-05-10 | 2022-05-31KEV since 2022 · listed over a year |
| 46 | CVE-2023-38035Ivanti — Ivanti Sentry Authentication Bypass VulnerabilityKEV since 2023 · listed over a year | 94 | 9.8 | 100.0% · 99.98th | 2023-08-22 | 2023-09-12KEV since 2023 · listed over a year |
| 47 | CVE-2018-10562Dasan — Dasan GPON Routers Command Injection VulnerabilityKEV since 2022 · listed over a year | 94 | 9.8 | 99.9% · 99.97th | 2022-03-31 | 2022-04-21KEV since 2022 · listed over a year |
| 48 | CVE-2021-3129Laravel — Laravel Ignition File Upload VulnerabilityKEV since 2023 · listed over a year | 94 | 9.8 | 99.9% · 99.97th | 2023-09-18 | 2023-10-09KEV since 2023 · listed over a year |
| 49 | CVE-2024-27198JetBrains — JetBrains TeamCity Authentication Bypass VulnerabilityKEV since 2024 · listed over a year | 94 | 9.8 | 99.9% · 99.97th | 2024-03-07 | 2024-03-28KEV since 2024 · listed over a year |
| 50 | CVE-2023-34362Progress — Progress MOVEit Transfer SQL Injection VulnerabilityKEV since 2023 · listed over a year | 94 | 9.8 | 99.9% · 99.97th | 2023-06-02 | 2023-06-23KEV since 2023 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.