Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 51 | CVE-2019-3396Atlassian — Atlassian Confluence Server and Data Center Server-Side Template Injection VulnerabilityRansomwareExigentKEV since 2021 · listed over a year | 94 | 9.8 | 99.9% · 99.97th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 52 | CVE-2021-20038SonicWall — SonicWall SMA 100 Appliances Stack-Based Buffer Overflow VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 94 | 9.8 | 99.9% · 99.97th | 2022-01-28 | 2022-02-11KEV since 2022 · listed over a year |
| 53 | CVE-2021-22986F5 — F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution VulnerabilityRansomwareExigentKEV since 2021 · listed over a year | 94 | 9.8 | 99.9% · 99.97th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 54 | CVE-2023-46604Apache — Apache ActiveMQ Deserialization of Untrusted Data VulnerabilityRansomwareExigentKEV since 2023 · listed over a year | 94 | 9.8 | 99.9% · 99.97th | 2023-11-02 | 2023-11-23KEV since 2023 · listed over a year |
| 55 | CVE-2021-21972VMware — VMware vCenter Server Remote Code Execution VulnerabilityRansomwareExigentKEV since 2021 · listed over a year | 94 | 9.8 | 99.9% · 99.96th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 56 | CVE-2024-0012Palo Alto Networks — Palo Alto Networks PAN-OS Management Interface Authentication Bypass VulnerabilityRansomwareExigentKEV since 2024 · listed over a year | 94 | 9.3 | 99.9% · 99.96th | 2024-11-18 | 2024-12-09KEV since 2024 · listed over a year |
| 57 | CVE-2022-47966Zoho — Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityRansomwareExigentKEV since 2023 · listed over a year | 94 | 9.8 | 99.8% · 99.95th | 2023-01-23 | 2023-02-13KEV since 2023 · listed over a year |
| 58 | CVE-2023-3519Citrix — Citrix NetScaler ADC and NetScaler Gateway Code Injection VulnerabilityRansomwareExigentKEV since 2023 · listed over a year | 94 | 9.8 | 99.7% · 99.95th | 2023-07-19 | 2023-08-09KEV since 2023 · listed over a year |
| 59 | CVE-2019-11043PHP — PHP FastCGI Process Manager (FPM) Buffer Overflow VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 94 | 9.8 | 99.7% · 99.95th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 60 | CVE-2010-2861Adobe — Adobe ColdFusion Directory Traversal VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 94 | 9.8 | 99.7% · 99.95th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 61 | CVE-2019-18935Progress — Progress Telerik UI for ASP.NET AJAX Deserialization of Untrusted Data VulnerabilityRansomwareExigentKEV since 2021 · listed over a year | 94 | 9.8 | 99.7% · 99.95th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 62 | CVE-2021-22205GitLab — GitLab Community and Enterprise Editions Remote Code Execution VulnerabilityRansomwareExigentKEV since 2021 · listed over a year | 94 | 10.0 | 99.7% · 99.95th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 63 | CVE-2019-15107Webmin — Webmin Command Injection VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 94 | 9.8 | 99.7% · 99.95th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 64 | CVE-2024-23692Rejetto — Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine VulnerabilityRansomwareExigentKEV since 2024 · listed over a year | 94 | 9.8 | 99.5% · 99.94th | 2024-07-09 | 2024-07-30KEV since 2024 · listed over a year |
| 65 | CVE-2022-42475Fortinet — Fortinet FortiOS Heap-Based Buffer Overflow VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 94 | 9.8 | 99.5% · 99.94th | 2022-12-13 | 2023-01-03KEV since 2022 · listed over a year |
| 66 | CVE-2017-7494Samba — Samba Remote Code Execution VulnerabilityRansomwareExigentKEV since 2023 · listed over a year | 94 | 9.8 | 99.4% · 99.94th | 2023-03-30 | 2023-04-20KEV since 2023 · listed over a year |
| 67 | CVE-2023-22515Atlassian — Atlassian Confluence Data Center and Server Broken Access Control VulnerabilityRansomwareExigentKEV since 2023 · listed over a year | 94 | 9.8 | 99.2% · 99.94th | 2023-10-05 | 2023-10-13KEV since 2023 · listed over a year |
| 68 | CVE-2018-7602Drupal — Drupal Core Remote Code Execution VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 94 | 9.8 | 99.2% · 99.94th | 2022-04-13 | 2022-05-04KEV since 2022 · listed over a year |
| 69 | CVE-2024-50623Cleo — Cleo Multiple Products Unrestricted File Upload VulnerabilityRansomwareExigentKEV since 2024 · listed over a year | 94 | 9.8 | 98.6% · 99.92nd | 2024-12-13 | 2025-01-03KEV since 2024 · listed over a year |
| 70 | CVE-2025-26399SolarWinds — SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilityRansomwareExigentCISA federal deadline · Overdue by 7 months | 94 | 9.8 | 90.1% · 99.8th | 2026-03-09 | 2026-03-12CISA federal deadline · Overdue by 7 months |
| 71 | CVE-2021-40438Apache — Apache HTTP Server-Side Request Forgery (SSRF)RansomwareExigentKEV since 2021 · listed over a year | 93 | 9.0 | 100.0% · 99.99th | 2021-12-01 | 2021-12-15KEV since 2021 · listed over a year |
| 72 | CVE-2024-21887Ivanti — Ivanti Connect Secure and Policy Secure Command Injection VulnerabilityRansomwareExigentKEV since 2024 · listed over a year | 93 | 9.1 | 100.0% · 99.99th | 2024-01-10 | 2024-01-22KEV since 2024 · listed over a year |
| 73 | CVE-2024-27199JetBrains — JetBrains TeamCity Relative Path Traversal VulnerabilityRansomwareCISA federal deadline · Overdue by 6 months | 93 | 7.3 | 100.0% · 99.99th | 2026-04-20 | 2026-05-04CISA federal deadline · Overdue by 6 months |
| 74 | CVE-2021-45046Apache — Apache Log4j2 Deserialization of Untrusted Data VulnerabilityRansomwareExigentKEV since 2023 · listed over a year | 93 | 9.0 | 100.0% · 99.98th | 2023-05-01 | 2023-05-22KEV since 2023 · listed over a year |
| 75 | CVE-2015-3306ProFTPD — ProFTPD Improper Access Control VulnerabilityExigentCISA federal deadline · Overdue by 11 days | 93 | 10.0 | 99.5% · 99.95th | 2026-10-08 | 2026-10-11CISA federal deadline · Overdue by 11 days |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.