Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 576 | CVE-2025-1316Edimax — Edimax IC-7100 IP Camera OS Command Injection VulnerabilityKEV since 2025 · listed over a year | 81 | 9.3 | 74.5% · 99.5th | 2025-03-19 | 2025-04-09KEV since 2025 · listed over a year |
| 577 | CVE-2025-2746Kentico — Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel VulnerabilityKEV since 2025 · listed over a year | 81 | 9.8 | 74.1% · 99.49th | 2025-10-20 | 2025-11-10KEV since 2025 · listed over a year |
| 578 | CVE-2025-20333Cisco — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Buffer Overflow VulnerabilityKEV since 2025 · listed over a year | 81 | 9.9 | 71.2% · 99.41st | 2025-09-25 | 2025-09-26KEV since 2025 · listed over a year |
| 579 | CVE-2025-59718Fortinet — Fortinet Multiple Products Improper Verification of Cryptographic Signature VulnerabilityCISA federal deadline · Overdue by 10 months | 81 | 9.8 | 68.3% · 99.33rd | 2025-12-16 | 2025-12-23CISA federal deadline · Overdue by 10 months |
| 580 | CVE-2026-82078PaperCut — PaperCut NG/MF Unsafe Reflection VulnerabilityCISA federal deadline · Overdue by 39 days | 81 | 9.4 | 63.5% · 99.21st | 2026-08-31 | 2026-09-14CISA federal deadline · Overdue by 39 days |
| 581 | CVE-2025-62593Ray-Project — Ray-Project Ray Code Injection VulnerabilityCISA federal deadline · Overdue by 2 months | 81 | 9.4 | 62.5% · 99.19th | 2026-08-17 | 2026-08-20CISA federal deadline · Overdue by 2 months |
| 582 | CVE-2022-23134Zabbix — Zabbix Frontend Improper Access Control VulnerabilityKEV since 2022 · listed over a year | 80 | 5.3 | 95.3% · 99.87th | 2022-02-22 | 2022-03-08KEV since 2022 · listed over a year |
| 583 | CVE-2020-8193Citrix — Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass VulnerabilityKEV since 2021 · listed over a year | 80 | 6.5 | 88.3% · 99.77th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 584 | CVE-2021-40655D-Link — D-Link DIR-605 Router Information Disclosure VulnerabilityKEV since 2024 · listed over a year | 80 | 7.5 | 86.7% · 99.74th | 2024-05-16 | 2024-06-06KEV since 2024 · listed over a year |
| 585 | CVE-2020-28949PEAR — PEAR Archive_Tar Deserialization of Untrusted Data VulnerabilityKEV since 2022 · listed over a year | 80 | 7.8 | 84.6% · 99.7th | 2022-08-25 | 2022-09-15KEV since 2022 · listed over a year |
| 586 | CVE-2023-28432MinIO — MinIO Information Disclosure VulnerabilityKEV since 2023 · listed over a year | 80 | 7.5 | 84.0% · 99.69th | 2023-04-21 | 2023-05-12KEV since 2023 · listed over a year |
| 587 | CVE-2015-3035TP-Link — TP-Link Multiple Archer Devices Directory Traversal VulnerabilityKEV since 2022 · listed over a year | 80 | 7.5 | 83.9% · 99.69th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 588 | CVE-2010-1297Adobe — Adobe Flash Player Memory Corruption VulnerabilityKEV since 2022 · listed over a year | 80 | 7.8 | 82.5% · 99.67th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 589 | CVE-2009-4324Adobe — Adobe Acrobat and Reader Use-After-Free VulnerabilityKEV since 2022 · listed over a year | 80 | 7.8 | 81.9% · 99.65th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 590 | CVE-2019-9621Synacor — Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) VulnerabilityKEV since 2025 · listed over a year | 80 | 7.5 | 81.0% · 99.63rd | 2025-07-07 | 2025-07-28KEV since 2025 · listed over a year |
| 591 | CVE-2023-22952SugarCRM — Multiple SugarCRM Products Remote Code Execution VulnerabilityKEV since 2023 · listed over a year | 80 | 8.8 | 80.1% · 99.62nd | 2023-02-02 | 2023-02-23KEV since 2023 · listed over a year |
| 592 | CVE-2020-6418Google — Google Chromium V8 Type Confusion VulnerabilityKEV since 2021 · listed over a year | 80 | 8.8 | 78.8% · 99.59th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 593 | CVE-2021-22555Linux — Linux Kernel Heap Out-of-Bounds Write VulnerabilityKEV since 2025 · listed over a year | 80 | 7.8 | 78.7% · 99.59th | 2025-10-06 | 2025-10-27KEV since 2025 · listed over a year |
| 594 | CVE-2020-10221rConfig — rConfig OS Command Injection VulnerabilityKEV since 2021 · listed over a year | 80 | 8.8 | 77.1% · 99.55th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 595 | CVE-2019-15949Nagios — Nagios XI Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 80 | 8.8 | 77.0% · 99.55th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 596 | CVE-2017-9248Progress — Progress Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness VulnerabilityKEV since 2021 · listed over a year | 80 | 9.8 | 75.1% · 99.51st | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 597 | CVE-2014-0780InduSoft — InduSoft Web Studio NTWebServer Directory Traversal VulnerabilityKEV since 2022 · listed over a year | 80 | 9.8 | 74.7% · 99.5th | 2022-04-15 | 2022-05-06KEV since 2022 · listed over a year |
| 598 | CVE-2005-2773Hewlett Packard (HP) — HP OpenView Network Node Manager Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 80 | 9.8 | 74.6% · 99.5th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 599 | CVE-2019-1003029Jenkins — Jenkins Script Security Plugin Sandbox Bypass VulnerabilityKEV since 2022 · listed over a year | 80 | 9.9 | 74.4% · 99.5th | 2022-04-25 | 2022-05-16KEV since 2022 · listed over a year |
| 600 | CVE-2018-14667Red Hat — Red Hat JBoss RichFaces Framework Expression Language Injection VulnerabilityKEV since 2023 · listed over a year | 80 | 9.8 | 74.2% · 99.49th | 2023-09-28 | 2023-10-19KEV since 2023 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.