Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 676 | CVE-2021-30632Google — Google Chromium V8 Out-of-Bounds Write VulnerabilityKEV since 2021 · listed over a year | 76 | 8.8 | 63.2% · 99.21st | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 677 | CVE-2020-4428IBM — IBM Data Risk Manager Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 76 | 9.1 | 61.7% · 99.17th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 678 | CVE-2025-53690Sitecore — Sitecore Multiple Products Deserialization of Untrusted Data VulnerabilityKEV since 2025 · listed over a year | 76 | 9.0 | 60.6% · 99.15th | 2025-09-04 | 2025-09-25KEV since 2025 · listed over a year |
| 679 | CVE-2024-8956PTZOptics — PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass VulnerabilityKEV since 2024 · listed over a year | 76 | 9.1 | 58.8% · 99.11st | 2024-11-04 | 2024-11-25KEV since 2024 · listed over a year |
| 680 | CVE-2020-26919NETGEAR — Netgear JGS516PE Devices Missing Function Level Access Control VulnerabilityKEV since 2021 · listed over a year | 76 | 9.8 | 57.5% · 99.08th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 681 | CVE-2019-11708Mozilla — Mozilla Firefox and Thunderbird Sandbox Escape VulnerabilityKEV since 2022 · listed over a year | 76 | 10.0 | 55.9% · 99.05th | 2022-05-23 | 2022-06-13KEV since 2022 · listed over a year |
| 682 | CVE-2026-2441Google — Google Chromium CSS Use-After-Free VulnerabilityCISA federal deadline · Overdue by 7 months | 76 | 8.8 | 55.0% · 99.03rd | 2026-02-17 | 2026-03-10CISA federal deadline · Overdue by 7 months |
| 683 | CVE-2024-38812VMware — VMware vCenter Server Heap-Based Buffer Overflow VulnerabilityKEV since 2024 · listed over a year | 76 | 9.8 | 54.6% · 99.02nd | 2024-11-20 | 2024-12-11KEV since 2024 · listed over a year |
| 684 | CVE-2026-85046Google — Google Chromium V8 Type Confusion VulnerabilityCISA federal deadline · Overdue by 35 days | 76 | 8.8 | 48.9% · 98.9th | 2026-09-04 | 2026-09-18CISA federal deadline · Overdue by 35 days |
| 685 | CVE-2026-39808Fortinet — Fortinet FortiSandbox OS Command Injection VulnerabilityCISA federal deadline · Overdue by 3 months | 76 | 9.8 | 47.4% · 98.8th | 2026-07-16 | 2026-07-19CISA federal deadline · Overdue by 3 months |
| 686 | CVE-2026-34910Ubiquiti — Ubiquiti UniFi OS Improper Input Validation VulnerabilityCISA federal deadline · Overdue by 4 months | 76 | 10.0 | 45.8% · 98.8th | 2026-06-23 | 2026-06-26CISA federal deadline · Overdue by 4 months |
| 687 | CVE-2023-49105ownCloud — ownCloud Improper Authentication VulnerabilityCISA federal deadline · Overdue by 54 days | 76 | 9.8 | 43.2% · 98.7th | 2026-08-27 | 2026-08-30CISA federal deadline · Overdue by 54 days |
| 688 | CVE-2026-105134Ahsay — Ahsay AhsayCBS Command Injection VulnerabilityCISA federal deadline · Overdue by 6 days | 76 | 9.3 | 38.3% · 98.6th | 2026-10-14 | 2026-10-17CISA federal deadline · Overdue by 6 days |
| 689 | CVE-2013-2423Oracle — Oracle JRE Unspecified VulnerabilityKEV since 2022 · listed over a year | 75 | 3.7 | 85.2% · 99.72nd | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 690 | CVE-2023-5631Roundcube — Roundcube Webmail Persistent Cross-Site Scripting (XSS) VulnerabilityKEV since 2023 · listed over a year | 75 | 5.4 | 76.9% · 99.55th | 2023-10-26 | 2023-11-16KEV since 2023 · listed over a year |
| 691 | CVE-2016-3718ImageMagick — ImageMagick Server-Side Request Forgery (SSRF) VulnerabilityKEV since 2021 · listed over a year | 75 | 5.5 | 75.6% · 99.52nd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 692 | CVE-2016-3715ImageMagick — ImageMagick Arbitrary File Deletion VulnerabilityKEV since 2021 · listed over a year | 75 | 5.5 | 75.3% · 99.52nd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 693 | CVE-2019-9978WordPress — WordPress Social Warfare Plugin Cross-Site Scripting (XSS) VulnerabilityKEV since 2021 · listed over a year | 75 | 6.1 | 72.9% · 99.45th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 694 | CVE-2022-28810Zoho — Zoho ManageEngine ADSelfService Plus Remote Code Execution VulnerabilityKEV since 2023 · listed over a year | 75 | 6.8 | 71.0% · 99.41st | 2023-03-07 | 2023-03-28KEV since 2023 · listed over a year |
| 695 | CVE-2016-11021D-Link — D-Link DCS-930L Devices OS Command Injection VulnerabilityKEV since 2022 · listed over a year | 75 | 7.2 | 68.9% · 99.35th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 696 | CVE-2020-4430IBM — IBM Data Risk Manager Directory Traversal VulnerabilityKEV since 2021 · listed over a year | 75 | 4.3 | 68.5% · 99.34th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 697 | CVE-2021-30657Apple — Apple macOS Unspecified VulnerabilityKEV since 2021 · listed over a year | 75 | 5.5 | 68.5% · 99.34th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 698 | CVE-2013-0631Adobe — Adobe ColdFusion Information Disclosure VulnerabilityKEV since 2022 · listed over a year | 75 | 7.5 | 66.4% · 99.28th | 2022-03-07 | 2022-09-07KEV since 2022 · listed over a year |
| 699 | CVE-2013-0629Adobe — Adobe ColdFusion Directory Traversal VulnerabilityKEV since 2022 · listed over a year | 75 | 7.5 | 65.8% · 99.27th | 2022-03-07 | 2022-09-07KEV since 2022 · listed over a year |
| 700 | CVE-2019-0211Apache — Apache HTTP Server Privilege Escalation VulnerabilityKEV since 2021 · listed over a year | 75 | 7.8 | 65.0% · 99.25th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.