Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,366 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 776 | CVE-2026-87902WordPress — WordPress Core Remote File Inclusion VulnerabilityCISA federal deadline · Overdue by 26 days | 75 | 8.1 | 40.0% · 98.6th | 2026-09-25 | 2026-09-28CISA federal deadline · Overdue by 26 days |
| 777 | CVE-2013-6282Linux — Linux Kernel Improper Input Validation VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 39.7% · 98.6th | 2022-09-15 | 2022-10-06KEV since 2022 · listed over a year |
| 778 | CVE-2021-27860FatPipe — FatPipe WARP, IPVPN, and MPVPN Configuration Upload exploitKEV since 2022 · listed over a year | 75 | 8.8 | 39.7% · 98.6th | 2022-01-10 | 2022-01-24KEV since 2022 · listed over a year |
| 779 | CVE-2023-39780ASUS — ASUS RT-AX55 Routers OS Command Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 8.8 | 39.5% · 98.6th | 2025-06-02 | 2025-06-23KEV since 2025 · listed over a year |
| 780 | CVE-2021-26828OpenPLC — OpenPLC ScadaBR Unrestricted Upload of File with Dangerous Type VulnerabilityCISA federal deadline · Overdue by 10 months | 75 | 8.8 | 39.1% · 98.6th | 2025-12-03 | 2025-12-24CISA federal deadline · Overdue by 10 months |
| 781 | CVE-2021-38003Google — Google Chromium V8 Memory Corruption VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 38.6% · 98.6th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 782 | CVE-2024-55550Mitel — Mitel MiCollab Path Traversal VulnerabilityRansomwareKEV since 2025 · listed over a year | 75 | 2.7 | 38.2% · 98.6th | 2025-01-07 | 2025-01-28KEV since 2025 · listed over a year |
| 783 | CVE-2018-13374Fortinet — Fortinet FortiOS and FortiADC Improper Access Control VulnerabilityRansomwareKEV since 2022 · listed over a year | 75 | 4.3 | 38.1% · 98.6th | 2022-09-08 | 2022-09-29KEV since 2022 · listed over a year |
| 784 | CVE-2008-0655Adobe — Adobe Acrobat and Reader Unspecified VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 37.9% · 98.5th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 785 | CVE-2026-39987Marimo — Marimo Remote Code Execution VulnerabilityCISA federal deadline · Overdue by 6 months | 75 | 9.3 | 37.9% · 98.5th | 2026-04-23 | 2026-05-07CISA federal deadline · Overdue by 6 months |
| 786 | CVE-2023-3079Google — Google Chromium V8 Type Confusion VulnerabilityKEV since 2023 · listed over a year | 75 | 8.8 | 37.9% · 98.5th | 2023-06-07 | 2023-06-28KEV since 2023 · listed over a year |
| 787 | CVE-2025-9377TP-Link — TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 8.6 | 37.7% · 98.5th | 2025-09-03 | 2025-09-24KEV since 2025 · listed over a year |
| 788 | CVE-2019-11707Mozilla — Mozilla Firefox and Thunderbird Type Confusion VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 37.7% · 98.5th | 2022-05-23 | 2022-06-13KEV since 2022 · listed over a year |
| 789 | CVE-2019-11001Reolink — Reolink Multiple IP Cameras OS Command Injection VulnerabilityKEV since 2024 · listed over a year | 75 | 7.2 | 37.5% · 98.5th | 2024-12-18 | 2025-01-08KEV since 2024 · listed over a year |
| 790 | CVE-2014-3153Linux — Linux Kernel Privilege Escalation VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 37.2% · 98.5th | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 791 | CVE-2021-38163SAP — SAP NetWeaver Unrestricted File Upload VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 36.9% · 98.5th | 2022-06-09 | 2022-06-30KEV since 2022 · listed over a year |
| 792 | CVE-2018-4990Adobe — Adobe Acrobat and Reader Double Free VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 36.2% · 98.5th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 793 | CVE-2020-5735Amcrest — Amcrest Cameras and NVR Stack-based Buffer Overflow VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 36.2% · 98.5th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 794 | CVE-2020-13671Drupal — Drupal core Un-restricted Upload of FileKEV since 2022 · listed over a year | 75 | 8.8 | 36.2% · 98.5th | 2022-01-18 | 2022-07-18KEV since 2022 · listed over a year |
| 795 | CVE-2021-39935GitLab — GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) VulnerabilityCISA federal deadline · Overdue by 8 months | 75 | 7.5 | 36.1% · 98.5th | 2026-02-03 | 2026-02-24CISA federal deadline · Overdue by 8 months |
| 796 | CVE-2017-6327Symantec — Symantec Messaging Gateway Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 35.9% · 98.5th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 797 | CVE-2018-17480Google — Google Chromium V8 Out-of-Bounds Write VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 35.6% · 98.5th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 798 | CVE-2025-21042Samsung — Samsung Mobile Devices Out-of-Bounds Write VulnerabilityCISA federal deadline · Overdue by 11 months | 75 | 9.8 | 35.6% · 98.5th | 2025-11-10 | 2025-12-01CISA federal deadline · Overdue by 11 months |
| 799 | CVE-2022-22960VMware — VMware Multiple Products Privilege Escalation VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 35.5% · 98.5th | 2022-04-15 | 2022-05-06KEV since 2022 · listed over a year |
| 800 | CVE-2026-20316Cisco — Cisco Secure Firewall Management Center Use of Hard-coded Password VulnerabilityRansomwareCISA federal deadline · Overdue by 3 months | 75 | 5.3 | 35.1% · 98.4th | 2026-07-29 | 2026-08-01CISA federal deadline · Overdue by 3 months |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.