Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,366 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 826 | CVE-2022-24682Synacor — Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting VulnerabilityRansomwareKEV since 2022 · listed over a year | 75 | 6.1 | 30.9% · 98.3rd | 2022-02-25 | 2022-03-11KEV since 2022 · listed over a year |
| 827 | CVE-2026-56290Joomlack — Joomlack Page Builder Improper Access Control VulnerabilityCISA federal deadline · Overdue by 3 months | 75 | 10.0 | 30.9% · 98.3rd | 2026-07-07 | 2026-07-10CISA federal deadline · Overdue by 3 months |
| 828 | CVE-2018-19953QNAP — QNAP NAS File Station Cross-Site Scripting VulnerabilityRansomwareKEV since 2022 · listed over a year | 75 | 6.1 | 30.5% · 98.2nd | 2022-05-24 | 2022-06-14KEV since 2022 · listed over a year |
| 829 | CVE-2021-27852Checkbox — Checkbox Survey Deserialization of Untrusted Data VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 30.3% · 98.2nd | 2022-04-11 | 2022-05-02KEV since 2022 · listed over a year |
| 830 | CVE-2019-3568Meta Platforms — WhatsApp VOIP Stack Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 30.1% · 98.2nd | 2022-04-19 | 2022-05-10KEV since 2022 · listed over a year |
| 831 | CVE-2019-13608Citrix — Citrix StoreFront Server XML External Entity (XXE) Processing VulnerabilityRansomwareKEV since 2021 · listed over a year | 75 | 7.5 | 30.0% · 98.2nd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 832 | CVE-2018-6882Synacor — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) VulnerabilityRansomwareKEV since 2022 · listed over a year | 75 | 6.1 | 29.8% · 98.2nd | 2022-04-19 | 2022-05-10KEV since 2022 · listed over a year |
| 833 | CVE-2026-76461Cisco — Cisco Secure Email Gateway SQL Injection VulnerabilityCISA federal deadline · Overdue by 37 days | 75 | 9.8 | 29.5% · 98.2nd | 2026-09-14 | 2026-09-17CISA federal deadline · Overdue by 37 days |
| 834 | CVE-2025-68686Fortinet — Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor VulnerabilityCISA federal deadline · Overdue by 2 months | 75 | 5.9 | 29.5% · 98.2nd | 2026-07-27 | 2026-08-10CISA federal deadline · Overdue by 2 months |
| 835 | CVE-2024-3393Palo Alto Networks — Palo Alto Networks PAN-OS Malicious DNS Packet VulnerabilityKEV since 2024 · listed over a year | 75 | 8.7 | 29.1% · 98.2nd | 2024-12-30 | 2025-01-20KEV since 2024 · listed over a year |
| 836 | CVE-2023-33010Zyxel — Zyxel Multiple Firewalls Buffer Overflow VulnerabilityKEV since 2023 · listed over a year | 75 | 9.8 | 29.0% · 98.2nd | 2023-06-05 | 2023-06-26KEV since 2023 · listed over a year |
| 837 | CVE-2014-3931Looking Glass — Multi-Router Looking Glass (MRLG) Buffer Overflow VulnerabilityKEV since 2025 · listed over a year | 75 | 9.8 | 29.0% · 98.2nd | 2025-07-07 | 2025-07-28KEV since 2025 · listed over a year |
| 838 | CVE-2018-2380SAP — SAP Customer Relationship Management (CRM) Path Traversal VulnerabilityRansomwareKEV since 2021 · listed over a year | 75 | 6.6 | 28.9% · 98.2nd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 839 | CVE-2021-30807Apple — Apple Multiple Products Memory Corruption VulnerabilityKEV since 2021 · listed over a year | 75 | 7.8 | 28.8% · 98.2nd | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 840 | CVE-2023-2533PaperCut — PaperCut NG/MF Cross-Site Request Forgery (CSRF) VulnerabilityKEV since 2025 · listed over a year | 75 | 8.8 | 28.8% · 98.2nd | 2025-07-28 | 2025-08-18KEV since 2025 · listed over a year |
| 841 | CVE-2026-9198IBM — IBM Langflow Code Injection VulnerabilityCISA federal deadline · Overdue by 3 months | 75 | 9.8 | 28.7% · 98.1st | 2026-08-04 | 2026-08-07CISA federal deadline · Overdue by 3 months |
| 842 | CVE-2024-11120GeoVision — GeoVision Devices OS Command Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 9.8 | 28.4% · 98.1st | 2025-05-07 | 2025-05-28KEV since 2025 · listed over a year |
| 843 | CVE-2020-3153Cisco — Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path VulnerabilityRansomwareKEV since 2022 · listed over a year | 75 | 6.5 | 28.3% · 98.1st | 2022-10-24 | 2022-11-14KEV since 2022 · listed over a year |
| 844 | CVE-2026-20262Cisco — Cisco Catalyst SD-WAN Manager Directory or Path Traversal VulnerabilityCISA federal deadline · Overdue by 4 months | 75 | 6.5 | 28.2% · 98.1st | 2026-06-15 | 2026-06-29CISA federal deadline · Overdue by 4 months |
| 845 | CVE-2019-19356Netis — Netis WF2419 Devices Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 75 | 7.5 | 28.2% · 98.1st | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 846 | CVE-2023-33009Zyxel — Zyxel Multiple Firewalls Buffer Overflow VulnerabilityKEV since 2023 · listed over a year | 75 | 9.8 | 28.1% · 98.1st | 2023-06-05 | 2023-06-26KEV since 2023 · listed over a year |
| 847 | CVE-2024-1086Linux — Linux Kernel Use-After-Free VulnerabilityRansomwareKEV since 2024 · listed over a year | 75 | 7.8 | 28.1% · 98.1st | 2024-05-30 | 2024-06-20KEV since 2024 · listed over a year |
| 848 | CVE-2025-27363FreeType — FreeType Out-of-Bounds Write VulnerabilityKEV since 2025 · listed over a year | 75 | 8.1 | 27.8% · 98.1st | 2025-05-06 | 2025-05-27KEV since 2025 · listed over a year |
| 849 | CVE-2018-4063Sierra Wireless — Sierra Wireless AirLink ALEOS Unrestricted Upload of File with Dangerous Type VulnerabilityCISA federal deadline · Overdue by 10 months | 75 | 8.8 | 27.3% · 98.1st | 2025-12-12 | 2026-01-02CISA federal deadline · Overdue by 10 months |
| 850 | CVE-2023-28205Apple — Apple Multiple Products WebKit Use-After-Free VulnerabilityKEV since 2023 · listed over a year | 75 | 8.8 | 27.1% · 98th | 2023-04-10 | 2023-05-01KEV since 2023 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.