Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,365 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 701 | CVE-2019-0211Apache — Apache HTTP Server Privilege Escalation VulnerabilityKEV since 2021 · listed over a year | 75 | 7.8 | 65.0% · 99.25th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 702 | CVE-2023-29552IETF — Service Location Protocol (SLP) Denial-of-Service VulnerabilityKEV since 2023 · listed over a year | 75 | 7.5 | 64.0% · 99.23rd | 2023-11-08 | 2023-11-29KEV since 2023 · listed over a year |
| 703 | CVE-2023-4911GNU — GNU C Library Buffer Overflow VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 63.8% · 99.22nd | 2023-11-21 | 2023-12-12KEV since 2023 · listed over a year |
| 704 | CVE-2023-43770Roundcube — Roundcube Webmail Persistent Cross-Site Scripting (XSS) VulnerabilityKEV since 2024 · listed over a year | 75 | 6.1 | 63.7% · 99.22nd | 2024-02-12 | 2024-03-04KEV since 2024 · listed over a year |
| 705 | CVE-2023-35081Ivanti — Ivanti Endpoint Manager Mobile (EPMM) Path Traversal VulnerabilityKEV since 2023 · listed over a year | 75 | 7.2 | 63.6% · 99.22nd | 2023-07-31 | 2023-08-21KEV since 2023 · listed over a year |
| 706 | CVE-2011-0609Adobe — Adobe Flash Player Unspecified VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 63.5% · 99.21st | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 707 | CVE-2019-8394Zoho — Zoho ManageEngine ServiceDesk Plus (SDP) File Upload VulnerabilityKEV since 2021 · listed over a year | 75 | 6.5 | 63.3% · 99.21st | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 708 | CVE-2025-47813Wing FTP Server — Wing FTP Server Information Disclosure VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 4.3 | 62.5% · 99.19th | 2026-03-16 | 2026-03-30CISA federal deadline · Overdue by 7 months |
| 709 | CVE-2019-5786Google — Google Chrome Blink Use-After-Free VulnerabilityKEV since 2022 · listed over a year | 75 | 6.5 | 61.1% · 99.16th | 2022-05-23 | 2022-06-13KEV since 2022 · listed over a year |
| 710 | CVE-2018-6065Google — Google Chromium V8 Integer Overflow VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 60.3% · 99.14th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 711 | CVE-2020-8655EyesOfNetwork — EyesOfNetwork Improper Privilege Management VulnerabilityKEV since 2021 · listed over a year | 75 | 7.8 | 60.1% · 99.13rd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 712 | CVE-2024-9380Ivanti — Ivanti Cloud Services Appliance (CSA) OS Command Injection VulnerabilityKEV since 2024 · listed over a year | 75 | 7.2 | 59.7% · 99.13rd | 2024-10-09 | 2024-10-30KEV since 2024 · listed over a year |
| 713 | CVE-2023-21608Adobe — Adobe Acrobat and Reader Use-After-Free VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 59.4% · 99.12nd | 2023-10-10 | 2023-10-31KEV since 2023 · listed over a year |
| 714 | CVE-2023-6549Citrix — Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow VulnerabilityKEV since 2024 · listed over a year | 75 | 7.5 | 57.6% · 99.09th | 2024-01-17 | 2024-02-07KEV since 2024 · listed over a year |
| 715 | CVE-2021-25297Nagios — Nagios XI OS Command InjectionKEV since 2022 · listed over a year | 75 | 8.8 | 56.7% · 99.06th | 2022-01-18 | 2022-02-01KEV since 2022 · listed over a year |
| 716 | CVE-2019-5825Google — Google Chromium V8 Out-of-Bounds Write VulnerabilityKEV since 2022 · listed over a year | 75 | 6.5 | 55.9% · 99.05th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 717 | CVE-2025-25181Advantive — Advantive VeraCore SQL Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 7.5 | 55.5% · 99.04th | 2025-03-10 | 2025-03-31KEV since 2025 · listed over a year |
| 718 | CVE-2025-32463Sudo — Sudo Inclusion of Functionality from Untrusted Control Sphere VulnerabilityKEV since 2025 · listed over a year | 75 | 7.8 | 55.5% · 99.04th | 2025-09-29 | 2025-10-20KEV since 2025 · listed over a year |
| 719 | CVE-2018-0125Cisco — Cisco VPN Routers Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 55.2% · 99.03rd | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 720 | CVE-2025-58034Fortinet — Fortinet FortiWeb OS Command Injection VulnerabilityCISA federal deadline · Overdue by 11 months | 75 | 7.2 | 54.7% · 99.02nd | 2025-11-18 | 2025-11-25CISA federal deadline · Overdue by 11 months |
| 721 | CVE-2006-1547Apache — Apache Struts 1 ActionForm Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 7.5 | 54.6% · 99.02nd | 2022-01-21 | 2022-07-21KEV since 2022 · listed over a year |
| 722 | CVE-2016-0984Adobe — Adobe Flash Player and AIR Use-After-Free VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 54.5% · 99.02nd | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 723 | CVE-2020-29557D-Link — D-Link DIR-825 R1 Devices Buffer Overflow VulnerabilityKEV since 2021 · listed over a year | 75 | 9.8 | 54.3% · 99.01st | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 724 | CVE-2023-20118Cisco — Cisco Small Business RV Series Routers Command Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 7.2 | 54.1% · 99.01st | 2025-03-03 | 2025-03-24KEV since 2025 · listed over a year |
| 725 | CVE-2020-25079D-Link — D-Link DCS-2530L and DCS-2670L Command Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 8.8 | 54.0% · 99th | 2025-08-05 | 2025-08-26KEV since 2025 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.