Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 601 | CVE-2024-21182Oracle — Oracle WebLogic Server Unspecified VulnerabilityCISA federal deadline · Overdue by 5 months | 80 | 7.5 | 74.2% · 99.49th | 2026-06-01 | 2026-06-04CISA federal deadline · Overdue by 5 months |
| 602 | CVE-2015-3043Adobe — Adobe Flash Player Memory Corruption VulnerabilityKEV since 2022 · listed over a year | 80 | 9.8 | 73.9% · 99.48th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 603 | CVE-2017-6316Citrix — Citrix Multiple Products Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 80 | 9.8 | 73.0% · 99.46th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 604 | CVE-2018-7841Schneider Electric — Schneider Electric U.motion Builder SQL Injection VulnerabilityKEV since 2022 · listed over a year | 80 | 9.8 | 72.7% · 99.45th | 2022-04-15 | 2022-05-06KEV since 2022 · listed over a year |
| 605 | CVE-2022-20699Cisco — Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 80 | 9.8 | 72.5% · 99.44th | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 606 | CVE-2010-4344Exim — Exim Heap-Based Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 80 | 9.8 | 71.7% · 99.42nd | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 607 | CVE-2021-22681Rockwell — Rockwell Multiple Products Insufficient Protected Credentials VulnerabilityCISA federal deadline · Overdue by 7 months | 80 | 9.8 | 63.6% · 99.22nd | 2026-03-05 | 2026-03-26CISA federal deadline · Overdue by 7 months |
| 608 | CVE-2026-0770Langflow — Langflow Inclusion of Functionality from Untrusted Control Sphere VulnerabilityCISA federal deadline · Overdue by 3 months | 80 | 9.8 | 62.6% · 99.19th | 2026-07-21 | 2026-07-24CISA federal deadline · Overdue by 3 months |
| 609 | CVE-2010-1428Red Hat — Red Hat JBoss Information Disclosure VulnerabilityRansomwareKEV since 2022 · listed over a year | 80 | 7.5 | 61.5% · 99.17th | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 610 | CVE-2023-36846Juniper — Juniper Junos OS SRX Series Missing Authentication for Critical Function VulnerabilityKEV since 2023 · listed over a year | 79 | 5.3 | 93.5% · 99.84th | 2023-11-13 | 2023-11-17KEV since 2023 · listed over a year |
| 611 | CVE-2020-11652SaltStack — SaltStack Salt Path Traversal VulnerabilityKEV since 2021 · listed over a year | 79 | 6.5 | 86.2% · 99.73rd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 612 | CVE-2020-11023JQuery — JQuery Cross-Site Scripting (XSS) VulnerabilityKEV since 2025 · listed over a year | 79 | 6.1 | 84.9% · 99.71st | 2025-01-23 | 2025-02-13KEV since 2025 · listed over a year |
| 613 | CVE-2019-0193Apache — Apache Solr DataImportHandler Code Injection VulnerabilityKEV since 2021 · listed over a year | 79 | 7.2 | 83.5% · 99.69th | 2021-12-10 | 2022-06-10KEV since 2021 · listed over a year |
| 614 | CVE-2016-5195Linux — Linux Kernel Race Condition VulnerabilityKEV since 2022 · listed over a year | 79 | 7.0 | 83.5% · 99.69th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 615 | CVE-2010-2883Adobe — Adobe Acrobat and Reader Stack-Based Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 79 | 7.3 | 81.4% · 99.64th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 616 | CVE-2021-21551Dell — Dell dbutil Driver Insufficient Access Control VulnerabilityKEV since 2022 · listed over a year | 79 | 7.8 | 80.1% · 99.62nd | 2022-03-31 | 2022-04-21KEV since 2022 · listed over a year |
| 617 | CVE-2024-8957PTZOptics — PTZOptics PT30X-SDI/NDI Cameras OS Command Injection VulnerabilityKEV since 2024 · listed over a year | 79 | 7.2 | 79.8% · 99.61st | 2024-11-04 | 2024-11-25KEV since 2024 · listed over a year |
| 618 | CVE-2018-15133Laravel — Laravel Deserialization of Untrusted Data VulnerabilityKEV since 2024 · listed over a year | 79 | 8.1 | 76.6% · 99.54th | 2024-01-16 | 2024-02-06KEV since 2024 · listed over a year |
| 619 | CVE-2019-12991Citrix — Citrix SD-WAN and NetScaler Command Injection VulnerabilityKEV since 2022 · listed over a year | 79 | 8.8 | 74.5% · 99.5th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 620 | CVE-2021-25298Nagios — Nagios XI OS Command InjectionKEV since 2022 · listed over a year | 79 | 8.8 | 73.6% · 99.47th | 2022-01-18 | 2022-02-01KEV since 2022 · listed over a year |
| 621 | CVE-2023-47565QNAP — QNAP VioStor NVR OS Command Injection VulnerabilityKEV since 2023 · listed over a year | 79 | 8.8 | 73.3% · 99.46th | 2023-12-21 | 2024-01-11KEV since 2023 · listed over a year |
| 622 | CVE-2025-30066tj-actions — tj-actions/changed-files GitHub Action Embedded Malicious Code VulnerabilityKEV since 2025 · listed over a year | 79 | 8.6 | 72.1% · 99.43rd | 2025-03-18 | 2025-04-08KEV since 2025 · listed over a year |
| 623 | CVE-2016-2386SAP — SAP NetWeaver SQL Injection VulnerabilityKEV since 2022 · listed over a year | 79 | 9.8 | 71.5% · 99.42nd | 2022-06-09 | 2022-06-30KEV since 2022 · listed over a year |
| 624 | CVE-2020-4427IBM — IBM Data Risk Manager Security Bypass VulnerabilityKEV since 2021 · listed over a year | 79 | 9.8 | 70.0% · 99.38th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 625 | CVE-2021-44026Roundcube — Roundcube Webmail SQL Injection VulnerabilityKEV since 2023 · listed over a year | 79 | 9.8 | 69.9% · 99.38th | 2023-06-22 | 2023-07-13KEV since 2023 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.