Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,366 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 901 | CVE-2024-7971Google — Google Chromium V8 Type Confusion VulnerabilityKEV since 2024 · listed over a year | 75 | 9.6 | 21.1% · 97.6th | 2024-08-26 | 2024-09-16KEV since 2024 · listed over a year |
| 902 | CVE-2025-31200Apple — Apple Multiple Products Memory Corruption VulnerabilityKEV since 2025 · listed over a year | 75 | 9.8 | 20.9% · 97.6th | 2025-04-17 | 2025-05-08KEV since 2025 · listed over a year |
| 903 | CVE-2014-9163Adobe — Adobe Flash Player Stack-Based Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 20.7% · 97.5th | 2022-04-13 | 2022-05-04KEV since 2022 · listed over a year |
| 904 | CVE-2024-40890Zyxel — Zyxel DSL CPE OS Command Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 8.8 | 20.7% · 97.5th | 2025-02-11 | 2025-03-04KEV since 2025 · listed over a year |
| 905 | CVE-2014-8439Adobe — Adobe Flash Player Dereferenced Pointer VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 20.4% · 97.5th | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 906 | CVE-2014-0196Linux — Linux Kernel Race Condition VulnerabilityKEV since 2023 · listed over a year | 75 | 5.5 | 20.3% · 97.5th | 2023-05-12 | 2023-06-02KEV since 2023 · listed over a year |
| 907 | CVE-2025-7775Citrix — Citrix NetScaler Memory Overflow VulnerabilityKEV since 2025 · listed over a year | 75 | 9.2 | 20.3% · 97.5th | 2025-08-26 | 2025-08-28KEV since 2025 · listed over a year |
| 908 | CVE-2025-66376Synacor — Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 6.1 | 20.2% · 97.5th | 2026-03-18 | 2026-04-01CISA federal deadline · Overdue by 7 months |
| 909 | CVE-2021-3199ONLYOFFICE — ONLYOFFICE Docs Server Path Traversal VulnerabilityCISA federal deadline · Overdue by 13 days | 75 | 9.8 | 20.1% · 97.5th | 2026-10-08 | 2026-10-11CISA federal deadline · Overdue by 13 days |
| 910 | CVE-2026-48939iCagenda — iCagenda Unrestricted Upload of File with Dangerous Type VulnerabilityCISA federal deadline · Overdue by 3 months | 75 | 10.0 | 20.1% · 97.4th | 2026-07-10 | 2026-07-13CISA federal deadline · Overdue by 3 months |
| 911 | CVE-2016-4171Adobe — Adobe Flash Player Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 20.1% · 97.4th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 912 | CVE-2023-50224TP-Link — TP-Link TL-WR841N Authentication Bypass by Spoofing VulnerabilityKEV since 2025 · listed over a year | 75 | 6.5 | 20.0% · 97.4th | 2025-09-03 | 2025-09-24KEV since 2025 · listed over a year |
| 913 | CVE-2021-21148Google — Google Chromium V8 Heap Buffer Overflow VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 20.0% · 97.4th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 914 | CVE-2025-67038Lantronix — Lantronix EDS5000 Code Injection VulnerabilityCISA federal deadline · Overdue by 4 months | 75 | 9.3 | 20.0% · 97.4th | 2026-06-23 | 2026-06-26CISA federal deadline · Overdue by 4 months |
| 915 | CVE-2021-37976Google — Google Chromium Information Disclosure VulnerabilityKEV since 2021 · listed over a year | 75 | 6.5 | 19.9% · 97.4th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 916 | CVE-2022-26871Trend Micro — Trend Micro Apex Central Arbitrary File Upload VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 19.5% · 97.4th | 2022-03-31 | 2022-04-21KEV since 2022 · listed over a year |
| 917 | CVE-2024-20359Cisco — Cisco ASA and FTD Privilege Escalation VulnerabilityKEV since 2024 · listed over a year | 75 | 6.0 | 19.4% · 97.4th | 2024-04-24 | 2024-05-01KEV since 2024 · listed over a year |
| 918 | CVE-2016-1010Adobe — Adobe Flash Player and AIR Integer Overflow VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 19.3% · 97.3rd | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 919 | CVE-2016-7836SKYSEA — SKYSEA Client View Improper Authentication VulnerabilityKEV since 2025 · listed over a year | 75 | 9.8 | 19.2% · 97.3rd | 2025-10-14 | 2025-11-04KEV since 2025 · listed over a year |
| 920 | CVE-2026-9586Sangoma — Sangoma Switchvox SQL Injection VulnerabilityCISA federal deadline · Overdue by 49 days | 75 | 9.3 | 19.0% · 97.3rd | 2026-09-02 | 2026-09-05CISA federal deadline · Overdue by 49 days |
| 921 | CVE-2023-7101Spreadsheet::ParseExcel — Spreadsheet::ParseExcel Remote Code Execution VulnerabilityKEV since 2024 · listed over a year | 75 | 7.8 | 19.0% · 97.3rd | 2024-01-02 | 2024-01-23KEV since 2024 · listed over a year |
| 922 | CVE-2023-37450Apple — Apple Multiple Products WebKit Code Execution VulnerabilityKEV since 2023 · listed over a year | 75 | 8.8 | 18.9% · 97.3rd | 2023-07-13 | 2023-08-03KEV since 2023 · listed over a year |
| 923 | CVE-2015-5123Adobe — Adobe Flash Player Use-After-Free VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 18.8% · 97.3rd | 2022-04-13 | 2022-05-04KEV since 2022 · listed over a year |
| 924 | CVE-2016-7892Adobe — Adobe Flash Player Use-After-Free VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 18.8% · 97.3rd | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 925 | CVE-2019-5591Fortinet — Fortinet FortiOS Default Configuration VulnerabilityRansomwareKEV since 2021 · listed over a year | 75 | 6.5 | 18.6% · 97.3rd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.