Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 551 | CVE-2020-14871Oracle — Oracle Solaris and Zettabyte File System (ZFS) Unspecified VulnerabilityKEV since 2021 · listed over a year | 82 | 10.0 | 80.2% · 99.62nd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 552 | CVE-2020-10987Tenda — Tenda AC1900 Router AC15 Model Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 82 | 9.8 | 79.8% · 99.61st | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 553 | CVE-2013-4810Hewlett Packard (HP) — HP Multiple Products Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 82 | 9.8 | 79.5% · 99.61st | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 554 | CVE-2025-6204Dassault Systèmes — Dassault Systèmes DELMIA Apriso Code Injection VulnerabilityCISA federal deadline · Overdue by 11 months | 82 | 8.0 | 79.2% · 99.6th | 2025-10-28 | 2025-11-18CISA federal deadline · Overdue by 11 months |
| 555 | CVE-2025-20337Cisco — Cisco Identity Services Engine Injection VulnerabilityKEV since 2025 · listed over a year | 82 | 10.0 | 74.5% · 99.5th | 2025-07-28 | 2025-08-18KEV since 2025 · listed over a year |
| 556 | CVE-2025-6205Dassault Systèmes — Dassault Systèmes DELMIA Apriso Missing Authorization VulnerabilityCISA federal deadline · Overdue by 11 months | 82 | 9.1 | 73.6% · 99.47th | 2025-10-28 | 2025-11-18CISA federal deadline · Overdue by 11 months |
| 557 | CVE-2015-7645Adobe — Adobe Flash Player Arbitrary Code Execution VulnerabilityRansomwareKEV since 2022 · listed over a year | 82 | 7.8 | 65.3% · 99.26th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 558 | CVE-2023-23752Joomla! — Joomla! Improper Access Control VulnerabilityKEV since 2024 · listed over a year | 81 | 5.3 | 99.8% · 99.96th | 2024-01-08 | 2024-01-29KEV since 2024 · listed over a year |
| 559 | CVE-2020-8243Ivanti — Ivanti Pulse Connect Secure Code Execution VulnerabilityKEV since 2021 · listed over a year | 81 | 7.2 | 90.8% · 99.81st | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 560 | CVE-2021-20123DrayTek — Draytek VigorConnect Path Traversal VulnerabilityKEV since 2024 · listed over a year | 81 | 7.5 | 90.2% · 99.8th | 2024-09-03 | 2024-09-24KEV since 2024 · listed over a year |
| 561 | CVE-2024-8190Ivanti — Ivanti Cloud Services Appliance OS Command Injection VulnerabilityKEV since 2024 · listed over a year | 81 | 7.2 | 88.5% · 99.78th | 2024-09-13 | 2024-10-04KEV since 2024 · listed over a year |
| 562 | CVE-2016-6415Cisco — Cisco IOS, IOS XR, and IOS XE IKEv1 Information Disclosure VulnerabilityKEV since 2023 · listed over a year | 81 | 7.5 | 87.7% · 99.76th | 2023-05-19 | 2023-06-09KEV since 2023 · listed over a year |
| 563 | CVE-2007-5659Adobe — Adobe Acrobat and Reader Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 81 | 7.8 | 87.4% · 99.76th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 564 | CVE-2016-9079Mozilla — Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free VulnerabilityKEV since 2023 · listed over a year | 81 | 7.5 | 87.4% · 99.76th | 2023-06-22 | 2023-07-13KEV since 2023 · listed over a year |
| 565 | CVE-2018-9276Paessler — Paessler PRTG Network Monitor OS Command Injection VulnerabilityKEV since 2025 · listed over a year | 81 | 7.2 | 87.0% · 99.75th | 2025-02-04 | 2025-02-25KEV since 2025 · listed over a year |
| 566 | CVE-2013-0640Adobe — Adobe Reader and Acrobat Memory Corruption VulnerabilityKEV since 2022 · listed over a year | 81 | 7.8 | 86.9% · 99.75th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 567 | CVE-2018-6961VMware — VMware SD-WAN Edge by VeloCloud Command Injection VulnerabilityKEV since 2022 · listed over a year | 81 | 8.1 | 85.3% · 99.72nd | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 568 | CVE-2010-1871Red Hat — Red Hat Linux JBoss Seam 2 Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 81 | 8.8 | 83.4% · 99.68th | 2021-12-10 | 2022-06-10KEV since 2021 · listed over a year |
| 569 | CVE-2009-3953Adobe — Adobe Acrobat and Reader Universal 3D Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 81 | 8.8 | 83.2% · 99.68th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 570 | CVE-2013-3346Adobe — Adobe Reader and Acrobat Memory Corruption VulnerabilityKEV since 2022 · listed over a year | 81 | 9.8 | 78.9% · 99.6th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 571 | CVE-2022-26318WatchGuard — WatchGuard Firebox and XTM Appliances Arbitrary Code ExecutionKEV since 2022 · listed over a year | 81 | 9.8 | 78.2% · 99.58th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 572 | CVE-2023-34192Synacor — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilityKEV since 2025 · listed over a year | 81 | 9.0 | 77.3% · 99.56th | 2025-02-25 | 2025-03-18KEV since 2025 · listed over a year |
| 573 | CVE-2019-7238Sonatype — Sonatype Nexus Repository Manager Incorrect Access Control VulnerabilityKEV since 2021 · listed over a year | 81 | 9.8 | 76.6% · 99.55th | 2021-12-10 | 2022-06-10KEV since 2021 · listed over a year |
| 574 | CVE-2012-0391Apache — Apache Struts 2 Improper Input Validation VulnerabilityKEV since 2022 · listed over a year | 81 | 9.8 | 75.6% · 99.52nd | 2022-01-21 | 2022-07-21KEV since 2022 · listed over a year |
| 575 | CVE-2010-0738Red Hat — Red Hat JBoss Authentication Bypass VulnerabilityRansomwareKEV since 2022 · listed over a year | 81 | 5.3 | 74.7% · 99.5th | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.