Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 476 | CVE-2017-17562Embedthis — Embedthis GoAhead Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 84 | 8.1 | 97.1% · 99.9th | 2021-12-10 | 2022-06-10KEV since 2021 · listed over a year |
| 477 | CVE-2017-8291Artifex — Artifex Ghostscript Type Confusion VulnerabilityKEV since 2022 · listed over a year | 84 | 7.8 | 97.0% · 99.89th | 2022-05-24 | 2022-06-14KEV since 2022 · listed over a year |
| 478 | CVE-2019-20500D-Link — D-Link DWL-2600AP Access Point Command Injection VulnerabilityKEV since 2023 · listed over a year | 84 | 7.8 | 96.7% · 99.89th | 2023-06-29 | 2023-07-20KEV since 2023 · listed over a year |
| 479 | CVE-2017-12637SAP — SAP NetWeaver Directory Traversal VulnerabilityKEV since 2025 · listed over a year | 84 | 7.5 | 95.1% · 99.87th | 2025-03-19 | 2025-04-09KEV since 2025 · listed over a year |
| 480 | CVE-2022-33891Apache — Apache Spark Command Injection VulnerabilityKEV since 2023 · listed over a year | 84 | 8.8 | 93.2% · 99.84th | 2023-03-07 | 2023-03-28KEV since 2023 · listed over a year |
| 481 | CVE-2020-17463Fuel CMS — Fuel CMS SQL Injection VulnerabilityKEV since 2021 · listed over a year | 84 | 9.8 | 89.7% · 99.79th | 2021-12-10 | 2022-06-10KEV since 2021 · listed over a year |
| 482 | CVE-2019-17621D-Link — D-Link DIR-859 Router Command Execution VulnerabilityKEV since 2023 · listed over a year | 84 | 9.8 | 89.6% · 99.79th | 2023-06-29 | 2023-07-20KEV since 2023 · listed over a year |
| 483 | CVE-2018-14839LG — LG N1A1 NAS Remote Command Execution VulnerabilityKEV since 2022 · listed over a year | 84 | 9.8 | 89.4% · 99.79th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 484 | CVE-2011-2462Adobe — Adobe Reader and Acrobat Universal 3D Memory Corruption VulnerabilityKEV since 2022 · listed over a year | 84 | 9.8 | 88.9% · 99.78th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 485 | CVE-2026-1603Ivanti — Ivanti Endpoint Manager (EPM) Authentication Bypass VulnerabilityCISA federal deadline · Overdue by 7 months | 84 | 7.5 | 88.3% · 99.77th | 2026-03-09 | 2026-03-23CISA federal deadline · Overdue by 7 months |
| 486 | CVE-2025-4428Ivanti — Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityKEV since 2025 · listed over a year | 84 | 8.8 | 88.0% · 99.77th | 2025-05-19 | 2025-06-09KEV since 2025 · listed over a year |
| 487 | CVE-2020-17496vBulletin — vBulletin PHP Module Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 84 | 9.8 | 87.5% · 99.76th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 488 | CVE-2022-26143Mitel — MiCollab, MiVoice Business Express Access Control VulnerabilityKEV since 2022 · listed over a year | 84 | 9.8 | 87.3% · 99.76th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 489 | CVE-2023-2868Barracuda Networks — Barracuda Networks ESG Appliance Improper Input Validation VulnerabilityKEV since 2023 · listed over a year | 84 | 9.8 | 86.8% · 99.75th | 2023-05-26 | 2023-06-16KEV since 2023 · listed over a year |
| 490 | CVE-2020-8644PlaySMS — PlaySMS Server-Side Template Injection VulnerabilityKEV since 2021 · listed over a year | 84 | 9.8 | 86.7% · 99.74th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 491 | CVE-2025-8110Gogs — Gogs Path Traversal VulnerabilityCISA federal deadline · Overdue by 9 months | 84 | 8.7 | 85.2% · 99.72nd | 2026-01-12 | 2026-02-02CISA federal deadline · Overdue by 9 months |
| 492 | CVE-2025-64328Sangoma — Sangoma FreePBX OS Command Injection VulnerabilityCISA federal deadline · Overdue by 8 months | 84 | 8.6 | 84.6% · 99.71st | 2026-02-03 | 2026-02-24CISA federal deadline · Overdue by 8 months |
| 493 | CVE-2019-9874Sitecore — Sitecore CMS and Experience Platform (XP) Deserialization VulnerabilityKEV since 2025 · listed over a year | 84 | 9.8 | 83.7% · 99.69th | 2025-03-26 | 2025-04-16KEV since 2025 · listed over a year |
| 494 | CVE-2025-14847MongoDB — MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency VulnerabilityCISA federal deadline · Overdue by 9 months | 84 | 8.7 | 83.2% · 99.68th | 2025-12-29 | 2026-01-19CISA federal deadline · Overdue by 9 months |
| 495 | CVE-2010-3765Mozilla — Mozilla Multiple Products Remote Code Execution VulnerabilityKEV since 2025 · listed over a year | 84 | 9.8 | 83.2% · 99.68th | 2025-10-06 | 2025-10-27KEV since 2025 · listed over a year |
| 496 | CVE-2025-34026Versa — Versa Concerto Improper Authentication VulnerabilityCISA federal deadline · Overdue by 8 months | 84 | 9.2 | 81.8% · 99.65th | 2026-01-22 | 2026-02-12CISA federal deadline · Overdue by 8 months |
| 497 | CVE-2020-11738WordPress — WordPress Snap Creek Duplicator Plugin File Download VulnerabilityKEV since 2021 · listed over a year | 83 | 7.5 | 97.8% · 99.91st | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 498 | CVE-2020-17519Apache — Apache Flink Improper Access Control VulnerabilityKEV since 2024 · listed over a year | 83 | 7.5 | 97.8% · 99.91st | 2024-05-23 | 2024-06-13KEV since 2024 · listed over a year |
| 499 | CVE-2020-14883Oracle — Oracle WebLogic Server Unspecified VulnerabilityKEV since 2021 · listed over a year | 83 | 7.2 | 97.7% · 99.91st | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 500 | CVE-2020-14864Oracle — Oracle Business Intelligence Enterprise Edition Path TransversalKEV since 2022 · listed over a year | 83 | 7.5 | 97.2% · 99.9th | 2022-01-18 | 2022-07-18KEV since 2022 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.