Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 501 | CVE-2020-8260Ivanti — Ivanti Pulse Connect Secure Code Execution VulnerabilityKEV since 2021 · listed over a year | 83 | 7.2 | 96.5% · 99.88th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 502 | CVE-2021-20124DrayTek — Draytek VigorConnect Path Traversal VulnerabilityKEV since 2024 · listed over a year | 83 | 7.5 | 96.3% · 99.88th | 2024-09-03 | 2024-09-24KEV since 2024 · listed over a year |
| 503 | CVE-2019-20085TVT — TVT NVMS-1000 Directory Traversal VulnerabilityKEV since 2021 · listed over a year | 83 | 7.5 | 96.1% · 99.88th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 504 | CVE-2017-3506Oracle — Oracle WebLogic Server OS Command Injection VulnerabilityKEV since 2024 · listed over a year | 83 | 7.4 | 96.0% · 99.88th | 2024-06-03 | 2024-06-24KEV since 2024 · listed over a year |
| 505 | CVE-2019-1652Cisco — Cisco Small Business Routers Improper Input Validation VulnerabilityKEV since 2022 · listed over a year | 83 | 7.2 | 95.9% · 99.88th | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 506 | CVE-2020-5410VMware Tanzu — VMware Tanzu Spring Cloud Config Directory Traversal VulnerabilityKEV since 2022 · listed over a year | 83 | 7.5 | 95.6% · 99.87th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 507 | CVE-2016-0752Rails — Ruby on Rails Directory Traversal VulnerabilityKEV since 2022 · listed over a year | 83 | 7.5 | 95.5% · 99.87th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 508 | CVE-2023-38950ZKTeco — ZKTeco BioTime Path Traversal VulnerabilityKEV since 2025 · listed over a year | 83 | 7.5 | 92.5% · 99.83rd | 2025-05-19 | 2025-06-09KEV since 2025 · listed over a year |
| 509 | CVE-2019-6340Drupal — Drupal Core Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 83 | 8.1 | 92.0% · 99.82nd | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 510 | CVE-2024-13160Ivanti — Ivanti Endpoint Manager (EPM) Absolute Path Traversal VulnerabilityKEV since 2025 · listed over a year | 83 | 7.5 | 91.0% · 99.81st | 2025-03-10 | 2025-03-31KEV since 2025 · listed over a year |
| 511 | CVE-2025-29635D-Link — D-Link DIR-823X Command Injection VulnerabilityCISA federal deadline · Overdue by 6 months | 83 | 7.2 | 87.9% · 99.77th | 2026-04-24 | 2026-05-08CISA federal deadline · Overdue by 6 months |
| 512 | CVE-2025-20362Cisco — Cisco Secure Firewall Adaptive Security (ASA) Appliance and Secure Firewall Threat Defense (FTD) Missing Authorization VulnerabilityKEV since 2025 · listed over a year | 83 | 8.6 | 87.1% · 99.75th | 2025-09-25 | 2025-09-26KEV since 2025 · listed over a year |
| 513 | CVE-2021-31755Tenda — Tenda AC11 Router Stack Buffer Overflow VulnerabilityKEV since 2021 · listed over a year | 83 | 9.8 | 86.5% · 99.74th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 514 | CVE-2019-4716IBM — IBM Planning Analytics Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 83 | 9.8 | 86.4% · 99.74th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 515 | CVE-2015-0311Adobe — Adobe Flash Player Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 83 | 9.8 | 85.6% · 99.73rd | 2022-04-13 | 2022-05-04KEV since 2022 · listed over a year |
| 516 | CVE-2019-10758MongoDB — MongoDB mongo-express Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 83 | 9.9 | 84.7% · 99.71st | 2021-12-10 | 2022-06-10KEV since 2021 · listed over a year |
| 517 | CVE-2024-28986SolarWinds — SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilityKEV since 2024 · listed over a year | 83 | 9.8 | 84.6% · 99.71st | 2024-08-15 | 2024-09-05KEV since 2024 · listed over a year |
| 518 | CVE-2019-11581Atlassian — Atlassian Jira Server and Data Center Server-Side Template Injection VulnerabilityKEV since 2022 · listed over a year | 83 | 9.8 | 84.6% · 99.71st | 2022-03-07 | 2022-09-07KEV since 2022 · listed over a year |
| 519 | CVE-2020-15415DrayTek — DrayTek Multiple Vigor Routers OS Command Injection VulnerabilityKEV since 2024 · listed over a year | 83 | 9.8 | 84.5% · 99.7th | 2024-09-30 | 2024-10-21KEV since 2024 · listed over a year |
| 520 | CVE-2020-12641Roundcube — Roundcube Webmail Remote Code Execution VulnerabilityKEV since 2023 · listed over a year | 83 | 9.8 | 84.5% · 99.7th | 2023-06-22 | 2023-07-13KEV since 2023 · listed over a year |
| 521 | CVE-2020-5722Grandstream — Grandstream Networks UCM6200 Series SQL Injection VulnerabilityKEV since 2022 · listed over a year | 83 | 9.8 | 84.4% · 99.7th | 2022-01-28 | 2022-07-28KEV since 2022 · listed over a year |
| 522 | CVE-2017-11317Telerik — Telerik UI for ASP.NET AJAX Unrestricted File Upload VulnerabilityKEV since 2022 · listed over a year | 83 | 9.8 | 84.2% · 99.7th | 2022-04-11 | 2022-05-02KEV since 2022 · listed over a year |
| 523 | CVE-2020-3161Cisco — Cisco IP Phones Web Server Remote Code Execution and Denial-of-Service VulnerabilityKEV since 2021 · listed over a year | 83 | 9.8 | 83.9% · 99.69th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 524 | CVE-2016-10174NETGEAR — NETGEAR WNR2000v5 Router Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 83 | 9.8 | 83.3% · 99.68th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 525 | CVE-2024-42009Roundcube — RoundCube Webmail Cross-Site Scripting VulnerabilityKEV since 2025 · listed over a year | 83 | 9.3 | 82.9% · 99.67th | 2025-06-09 | 2025-06-30KEV since 2025 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.