Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 626 | CVE-2017-6077NETGEAR — NETGEAR DGN2200 Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 79 | 9.8 | 68.7% · 99.34th | 2022-03-07 | 2022-09-07KEV since 2022 · listed over a year |
| 627 | CVE-2025-2776SysAid — SysAid On-Prem Improper Restriction of XML External Entity Reference VulnerabilityKEV since 2025 · listed over a year | 79 | 9.8 | 64.7% · 99.25th | 2025-07-22 | 2025-08-12KEV since 2025 · listed over a year |
| 628 | CVE-2025-58360OSGeo — OSGeo GeoServer Improper Restriction of XML External Entity Reference VulnerabilityCISA federal deadline · Overdue by 10 months | 79 | 9.8 | 60.0% · 99.13rd | 2025-12-11 | 2026-01-01CISA federal deadline · Overdue by 10 months |
| 629 | CVE-2026-85102Check Point — Check Point Multiple Products Improper Certificate Validation VulnerabilityCISA federal deadline · Overdue by 28 days | 79 | 9.8 | 54.2% · 99.01st | 2026-09-22 | 2026-09-25CISA federal deadline · Overdue by 28 days |
| 630 | CVE-2023-36844Juniper — Juniper Junos OS EX Series PHP External Variable Modification VulnerabilityKEV since 2023 · listed over a year | 78 | 5.3 | 90.0% · 99.8th | 2023-11-13 | 2023-11-17KEV since 2023 · listed over a year |
| 631 | CVE-2021-21973VMware — VMware vCenter Server and Cloud Foundation Server Side Request Forgery (SSRF) VulnerabilityKEV since 2022 · listed over a year | 78 | 5.3 | 88.0% · 99.77th | 2022-03-07 | 2022-03-21KEV since 2022 · listed over a year |
| 632 | CVE-2023-49103ownCloud — ownCloud graphapi Information Disclosure VulnerabilityKEV since 2023 · listed over a year | 78 | 7.5 | 78.4% · 99.59th | 2023-11-30 | 2023-12-21KEV since 2023 · listed over a year |
| 633 | CVE-2020-8816Pi-hole — Pi-Hole AdminLTE Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 78 | 7.2 | 78.3% · 99.58th | 2021-12-10 | 2022-06-10KEV since 2021 · listed over a year |
| 634 | CVE-2021-38406Delta Electronics — Delta Electronics DOPSoft 2 Improper Input Validation VulnerabilityKEV since 2022 · listed over a year | 78 | 7.8 | 76.4% · 99.54th | 2022-08-25 | 2022-09-15KEV since 2022 · listed over a year |
| 635 | CVE-2018-15811DotNetNuke (DNN) — DotNetNuke (DNN) Inadequate Encryption Strength VulnerabilityKEV since 2021 · listed over a year | 78 | 7.5 | 76.3% · 99.54th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 636 | CVE-2023-44221SonicWall — SonicWall SMA100 Appliances OS Command Injection VulnerabilityKEV since 2025 · listed over a year | 78 | 7.2 | 76.2% · 99.54th | 2025-05-01 | 2025-05-22KEV since 2025 · listed over a year |
| 637 | CVE-2021-30860Apple — Apple Multiple Products Integer Overflow VulnerabilityKEV since 2021 · listed over a year | 78 | 7.8 | 76.0% · 99.53rd | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 638 | CVE-2017-6334NETGEAR — NETGEAR DGN2200 Devices OS Command Injection VulnerabilityKEV since 2022 · listed over a year | 78 | 8.8 | 72.6% · 99.45th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 639 | CVE-2021-25296Nagios — Nagios XI OS Command InjectionKEV since 2022 · listed over a year | 78 | 8.8 | 71.9% · 99.43rd | 2022-01-18 | 2022-02-01KEV since 2022 · listed over a year |
| 640 | CVE-2024-20353Cisco — Cisco ASA and FTD Denial of Service VulnerabilityKEV since 2024 · listed over a year | 78 | 8.6 | 70.7% · 99.4th | 2024-04-24 | 2024-05-01KEV since 2024 · listed over a year |
| 641 | CVE-2021-21220Google — Google Chromium V8 Improper Input Validation VulnerabilityKEV since 2021 · listed over a year | 78 | 8.8 | 70.4% · 99.39th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 642 | CVE-2017-6736Cisco — Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 78 | 8.8 | 70.4% · 99.39th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 643 | CVE-2016-20017D-Link — D-Link DSL-2750B Devices Command Injection VulnerabilityKEV since 2024 · listed over a year | 78 | 9.8 | 66.6% · 99.29th | 2024-01-08 | 2024-01-29KEV since 2024 · listed over a year |
| 644 | CVE-2013-2729Adobe — Adobe Reader and Acrobat Arbitrary Integer Overflow VulnerabilityKEV since 2022 · listed over a year | 78 | 9.8 | 66.6% · 99.29th | 2022-03-28 | 2022-04-18KEV since 2022 · listed over a year |
| 645 | CVE-2015-7755Juniper — Juniper ScreenOS Improper Authentication VulnerabilityKEV since 2025 · listed over a year | 78 | 9.8 | 61.1% · 99.16th | 2025-10-02 | 2025-10-23KEV since 2025 · listed over a year |
| 646 | CVE-2024-54085AMI — AMI MegaRAC SPx Authentication Bypass by Spoofing VulnerabilityKEV since 2025 · listed over a year | 78 | 10.0 | 60.7% · 99.15th | 2025-06-25 | 2025-07-16KEV since 2025 · listed over a year |
| 647 | CVE-2019-19006Sangoma — Sangoma FreePBX Improper Authentication VulnerabilityCISA federal deadline · Overdue by 8 months | 78 | 9.8 | 55.9% · 99.05th | 2026-02-03 | 2026-02-24CISA federal deadline · Overdue by 8 months |
| 648 | CVE-2022-37055D-Link — D-Link Routers Buffer Overflow VulnerabilityCISA federal deadline · Overdue by 10 months | 78 | 9.8 | 55.5% · 99.04th | 2025-12-08 | 2025-12-29CISA federal deadline · Overdue by 10 months |
| 649 | CVE-2023-36847Juniper — Juniper Junos OS EX Series Missing Authentication for Critical Function VulnerabilityKEV since 2023 · listed over a year | 77 | 5.3 | 83.5% · 99.69th | 2023-11-13 | 2023-11-17KEV since 2023 · listed over a year |
| 650 | CVE-2018-18809TIBCO — TIBCO JasperReports Library Directory Traversal VulnerabilityKEV since 2022 · listed over a year | 77 | 6.5 | 79.1% · 99.6th | 2022-12-29 | 2023-01-19KEV since 2022 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.