Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,366 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 976 | CVE-2017-12240Cisco — Cisco IOS and IOS XE Software DHCP Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 13.8% · 96.5th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 977 | CVE-2024-12686BeyondTrust — BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 7.2 | 13.7% · 96.5th | 2025-01-13 | 2025-02-03KEV since 2025 · listed over a year |
| 978 | CVE-2023-20867VMware — VMware Tools Authentication Bypass VulnerabilityKEV since 2023 · listed over a year | 75 | 3.9 | 13.6% · 96.5th | 2023-06-23 | 2023-07-14KEV since 2023 · listed over a year |
| 979 | CVE-2015-4902Oracle — Oracle Java SE Integrity Check VulnerabilityKEV since 2022 · listed over a year | 75 | 5.3 | 13.6% · 96.5th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 980 | CVE-2026-22769Dell — Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials VulnerabilityCISA federal deadline · Overdue by 8 months | 75 | 10.0 | 13.5% · 96.5th | 2026-02-18 | 2026-02-21CISA federal deadline · Overdue by 8 months |
| 981 | CVE-2021-27876Veritas — Veritas Backup Exec Agent File Access VulnerabilityRansomwareKEV since 2023 · listed over a year | 75 | 8.1 | 13.5% · 96.4th | 2023-04-07 | 2023-04-28KEV since 2023 · listed over a year |
| 982 | CVE-2019-3010Oracle — Oracle Solaris Privilege Escalation VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 13.4% · 96.4th | 2022-05-25 | 2022-06-15KEV since 2022 · listed over a year |
| 983 | CVE-2023-41991Apple — Apple Multiple Products Improper Certificate Validation VulnerabilityKEV since 2023 · listed over a year | 75 | 5.5 | 13.4% · 96.4th | 2023-09-25 | 2023-10-16KEV since 2023 · listed over a year |
| 984 | CVE-2021-30858Apple — Apple iOS, iPadOS, macOS Use-After-Free VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 13.4% · 96.4th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 985 | CVE-2026-86218N-able — N-able N-central Static Code Injection VulnerabilityCISA federal deadline · Overdue by 43 days | 75 | 10.0 | 13.3% · 96.4th | 2026-09-08 | 2026-09-11CISA federal deadline · Overdue by 43 days |
| 986 | CVE-2022-22948VMware — VMware vCenter Server Incorrect Default File Permissions VulnerabilityKEV since 2024 · listed over a year | 75 | 6.5 | 13.3% · 96.4th | 2024-07-17 | 2024-08-07KEV since 2024 · listed over a year |
| 987 | CVE-2026-21589Atlassian — Atlassian Multiple Products Files or Directories Accessible to External Parties VulnerabilityCISA federal deadline · Overdue by 6 days | 75 | 9.3 | 12.7% · 96.3rd | 2026-10-15 | 2026-10-18CISA federal deadline · Overdue by 6 days |
| 988 | CVE-2022-22675Apple — Apple macOS Out-of-Bounds Write VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 12.5% · 96.2nd | 2022-04-04 | 2022-04-25KEV since 2022 · listed over a year |
| 989 | CVE-2022-20775Cisco — Cisco SD-WAN Path Traversal VulnerabilityCISA federal deadline · Overdue by 8 months | 75 | 7.8 | 12.5% · 96.2nd | 2026-02-25 | 2026-02-27CISA federal deadline · Overdue by 8 months |
| 990 | CVE-2023-32373Apple — Apple Multiple Products WebKit Use-After-Free VulnerabilityKEV since 2023 · listed over a year | 75 | 8.8 | 12.2% · 96.2nd | 2023-05-22 | 2023-06-12KEV since 2023 · listed over a year |
| 991 | CVE-2021-28663Arm — Arm Mali Graphics Processing Unit (GPU) Use-After-Free VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 12.1% · 96.1st | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 992 | CVE-2017-11292Adobe — Adobe Flash Player Type Confusion VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 11.9% · 96.1st | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 993 | CVE-2020-8599Trend Micro — Trend Micro Apex One and OfficeScan Authentication Bypass VulnerabilityKEV since 2021 · listed over a year | 75 | 9.8 | 11.9% · 96.1st | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 994 | CVE-2026-15410SonicWall — SonicWall SMA1000 Appliances Code Injection VulnerabilityRansomwareCISA federal deadline · Overdue by 3 months | 75 | 7.2 | 11.8% · 96.1st | 2026-07-14 | 2026-07-17CISA federal deadline · Overdue by 3 months |
| 995 | CVE-2021-37973Google — Google Chromium Portals Use-After-Free VulnerabilityKEV since 2021 · listed over a year | 75 | 9.6 | 11.7% · 96.1st | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 996 | CVE-2020-3118Cisco — Cisco IOS XR Software Discovery Protocol Format String VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 11.7% · 96.1st | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 997 | CVE-2022-22587Apple — Apple Memory Corruption VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 11.6% · 96.1st | 2022-01-28 | 2022-02-11KEV since 2022 · listed over a year |
| 998 | CVE-2022-20821Cisco — Cisco IOS XR Open Port VulnerabilityKEV since 2022 · listed over a year | 75 | 6.5 | 11.5% · 96th | 2022-05-23 | 2022-06-13KEV since 2022 · listed over a year |
| 999 | CVE-2025-48927TeleMessage — TeleMessage TM SGNL Initialization of a Resource with an Insecure Default VulnerabilityKEV since 2025 · listed over a year | 75 | 5.3 | 11.1% · 95.9th | 2025-07-01 | 2025-07-22KEV since 2025 · listed over a year |
| 1000 | CVE-2017-6740Cisco — Cisco IOS and IOS XE Software SNMP Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 11.1% · 95.9th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.