Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,366 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 876 | CVE-2025-54948Trend Micro — Trend Micro Apex One OS Command Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 9.8 | 23.9% · 97.8th | 2025-08-18 | 2025-09-08KEV since 2025 · listed over a year |
| 877 | CVE-2021-3560Red Hat — Red Hat Polkit Incorrect Authorization VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 23.7% · 97.8th | 2023-05-12 | 2023-06-02KEV since 2023 · listed over a year |
| 878 | CVE-2016-4656Apple — Apple iOS Memory Corruption VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 23.6% · 97.8th | 2022-05-24 | 2022-06-14KEV since 2022 · listed over a year |
| 879 | CVE-2022-4262Google — Google Chromium V8 Type Confusion VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 23.5% · 97.8th | 2022-12-05 | 2022-12-26KEV since 2022 · listed over a year |
| 880 | CVE-2023-28206Apple — Apple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write VulnerabilityKEV since 2023 · listed over a year | 75 | 8.6 | 23.2% · 97.8th | 2023-04-10 | 2023-05-01KEV since 2023 · listed over a year |
| 881 | CVE-2026-19490Citrix — Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel VulnerabilityCISA federal deadline · Overdue by 42 days | 75 | 9.3 | 23.2% · 97.8th | 2026-09-09 | 2026-09-12CISA federal deadline · Overdue by 42 days |
| 882 | CVE-2015-5317Jenkins — Jenkins User Interface (UI) Information Disclosure VulnerabilityKEV since 2023 · listed over a year | 75 | 7.5 | 23.0% · 97.8th | 2023-05-12 | 2023-06-02KEV since 2023 · listed over a year |
| 883 | CVE-2023-32435Apple — Apple Multiple Products WebKit Memory Corruption VulnerabilityKEV since 2023 · listed over a year | 75 | 8.8 | 23.0% · 97.7th | 2023-06-23 | 2023-07-14KEV since 2023 · listed over a year |
| 884 | CVE-2021-22899Ivanti — Ivanti Pulse Connect Secure Command Injection VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 22.9% · 97.7th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 885 | CVE-2024-40891Zyxel — Zyxel DSL CPE OS Command Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 8.8 | 22.9% · 97.7th | 2025-02-11 | 2025-03-04KEV since 2025 · listed over a year |
| 886 | CVE-2018-19943QNAP — QNAP NAS File Station Cross-Site Scripting VulnerabilityRansomwareKEV since 2022 · listed over a year | 75 | 5.4 | 22.7% · 97.7th | 2022-05-24 | 2022-06-14KEV since 2022 · listed over a year |
| 887 | CVE-2024-44309Apple — Apple Multiple Products Cross-Site Scripting (XSS) VulnerabilityKEV since 2024 · listed over a year | 75 | 6.3 | 22.6% · 97.7th | 2024-11-21 | 2024-12-12KEV since 2024 · listed over a year |
| 888 | CVE-2016-6367Cisco — Cisco Adaptive Security Appliance (ASA) CLI Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 22.6% · 97.7th | 2022-05-24 | 2022-06-14KEV since 2022 · listed over a year |
| 889 | CVE-2014-2120Cisco — Cisco Adaptive Security Appliance (ASA) Cross-Site Scripting (XSS) VulnerabilityKEV since 2024 · listed over a year | 75 | 6.1 | 22.6% · 97.7th | 2024-11-12 | 2024-12-03KEV since 2024 · listed over a year |
| 890 | CVE-2022-0609Google — Google Chromium Animation Use-After-Free VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 22.4% · 97.7th | 2022-02-15 | 2022-03-01KEV since 2022 · listed over a year |
| 891 | CVE-2024-37079Broadcom — Broadcom VMware vCenter Server Out-of-bounds Write VulnerabilityCISA federal deadline · Overdue by 8 months | 75 | 9.8 | 22.4% · 97.7th | 2026-01-23 | 2026-02-13CISA federal deadline · Overdue by 8 months |
| 892 | CVE-2014-0546Adobe — Adobe Reader and Acrobat Sandbox Bypass VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 22.3% · 97.7th | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 893 | CVE-2025-14174Google — Google Chromium Out of Bounds Memory Access VulnerabilityCISA federal deadline · Overdue by 10 months | 75 | 8.8 | 22.3% · 97.7th | 2025-12-12 | 2026-01-02CISA federal deadline · Overdue by 10 months |
| 894 | CVE-2020-24363TP-Link — TP-link TL-WA855RE Missing Authentication for Critical Function VulnerabilityKEV since 2025 · listed over a year | 75 | 8.8 | 22.2% · 97.7th | 2025-09-02 | 2025-09-23KEV since 2025 · listed over a year |
| 895 | CVE-2020-27930Apple — Apple Multiple Products Memory Corruption VulnerabilityKEV since 2021 · listed over a year | 75 | 7.8 | 22.0% · 97.7th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 896 | CVE-2025-23209Craft CMS — Craft CMS Code Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 8.1 | 21.8% · 97.6th | 2025-02-20 | 2025-03-13KEV since 2025 · listed over a year |
| 897 | CVE-2017-6742Cisco — Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityKEV since 2023 · listed over a year | 75 | 8.8 | 21.4% · 97.6th | 2023-04-19 | 2023-05-10KEV since 2023 · listed over a year |
| 898 | CVE-2020-9377D-Link — D-Link DIR-610 Devices Remote Command ExecutionKEV since 2022 · listed over a year | 75 | 8.8 | 21.3% · 97.6th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 899 | CVE-2009-1862Adobe — Adobe Acrobat and Reader, Flash Player Unspecified VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 21.2% · 97.6th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 900 | CVE-2012-5054Adobe — Adobe Flash Player Integer Overflow VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 21.2% · 97.6th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.