Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,366 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 1101 | CVE-2026-42208BerriAI — BerriAI LiteLLM SQL Injection VulnerabilityCISA federal deadline · Overdue by 5 months | 75 | 9.3 | 5.8% · 93.1st | 2026-05-08 | 2026-05-11CISA federal deadline · Overdue by 5 months |
| 1102 | CVE-2023-2136Google — Google Chrome Skia Integer Overflow VulnerabilityKEV since 2023 · listed over a year | 75 | 9.6 | 5.7% · 93rd | 2023-04-21 | 2023-05-12KEV since 2023 · listed over a year |
| 1103 | CVE-2026-48558SimpleHelp — SimpleHelp Authentication Bypass VulnerabilityCISA federal deadline · Overdue by 4 months | 75 | 9.5 | 5.7% · 93rd | 2026-06-29 | 2026-07-02CISA federal deadline · Overdue by 4 months |
| 1104 | CVE-2010-3035Cisco — Cisco IOS XR Border Gateway Protocol (BGP) Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 7.5 | 5.7% · 93rd | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 1105 | CVE-2022-20700Cisco — Cisco Small Business RV Series Routers Stack-based Buffer Overflow VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 5.7% · 92.9th | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 1106 | CVE-2022-32917Apple — Apple iOS, iPadOS, and macOS Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 5.6% · 92.9th | 2022-09-14 | 2022-10-05KEV since 2022 · listed over a year |
| 1107 | CVE-2022-0492Linux — Linux Kernel Improper Authentication VulnerabilityCISA federal deadline · Overdue by 5 months | 75 | 7.8 | 5.5% · 92.8th | 2026-06-02 | 2026-06-05CISA federal deadline · Overdue by 5 months |
| 1108 | CVE-2019-15271Cisco — Cisco RV Series Routers Deserialization of Untrusted Data VulnerabilityKEV since 2022 · listed over a year | 75 | 8.8 | 5.5% · 92.8th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 1109 | CVE-2021-28664Arm — Arm Mali Graphics Processing Unit (GPU) Unspecified VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 5.4% · 92.7th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1110 | CVE-2025-10585Google — Google Chromium V8 Type Confusion VulnerabilityKEV since 2025 · listed over a year | 75 | 9.8 | 5.4% · 92.7th | 2025-09-23 | 2025-10-14KEV since 2025 · listed over a year |
| 1111 | CVE-2026-60137WordPress — WordPress Core SQL Injection VulnerabilityCISA federal deadline · Overdue by 3 months | 75 | 5.9 | 5.3% · 92.6th | 2026-07-21 | 2026-08-04CISA federal deadline · Overdue by 3 months |
| 1112 | CVE-2026-88772Citrix — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCISA federal deadline · Overdue by 24 days | 75 | 9.5 | 5.3% · 92.6th | 2026-09-27 | 2026-09-30CISA federal deadline · Overdue by 24 days |
| 1113 | CVE-2026-25108Soliton Systems K.K — Soliton Systems K.K FileZen OS Command Injection VulnerabilityCISA federal deadline · Overdue by 7 months | 75 | 8.7 | 5.2% · 92.5th | 2026-02-24 | 2026-03-17CISA federal deadline · Overdue by 7 months |
| 1114 | CVE-2017-12319Cisco — Cisco IOS XE Software Ethernet Virtual Private Network Border Gateway Protocol Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 5.9 | 5.2% · 92.5th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 1115 | CVE-2021-30900Apple — Apple iOS, iPadOS, and macOS Out-of-Bounds Write VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 5.2% · 92.5th | 2023-03-30 | 2023-04-20KEV since 2023 · listed over a year |
| 1116 | CVE-2025-54313Prettier — Prettier eslint-config-prettier Embedded Malicious Code VulnerabilityCISA federal deadline · Overdue by 8 months | 75 | 7.5 | 5.1% · 92.4th | 2026-01-22 | 2026-02-12CISA federal deadline · Overdue by 8 months |
| 1117 | CVE-2015-5287Red Hat — Red Hat Automatic Bug Reporting Tool Privilege Escalation VulnerabilityCISA federal deadline · Overdue by 45 days | 75 | 7.8 | 5.0% · 92.2nd | 2026-08-26 | 2026-09-09CISA federal deadline · Overdue by 45 days |
| 1118 | CVE-2021-36741Trend Micro — Trend Micro Multiple Products Improper Input Validation VulnerabilityKEV since 2021 · listed over a year | 75 | 8.8 | 5.0% · 92.1st | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1119 | CVE-2019-16256SIMalliance — SIMalliance Toolbox Browser Command Injection VulnerabilityKEV since 2021 · listed over a year | 75 | 9.8 | 4.9% · 92.1st | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1120 | CVE-2021-38000Google — Google Chromium Intents Improper Input Validation VulnerabilityKEV since 2021 · listed over a year | 75 | 6.1 | 4.9% · 92.1st | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1121 | CVE-2018-0179Cisco — Cisco IOS Software Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 5.9 | 4.9% · 92.1st | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 1122 | CVE-2018-0180Cisco — Cisco IOS Software Denial-of-Service VulnerabilityKEV since 2022 · listed over a year | 75 | 5.9 | 4.9% · 92.1st | 2022-03-03 | 2022-03-17KEV since 2022 · listed over a year |
| 1123 | CVE-2025-47827IGEL — IGEL OS Use of a Key Past its Expiration Date VulnerabilityKEV since 2025 · listed over a year | 75 | 4.6 | 4.9% · 92.1st | 2025-10-14 | 2025-11-04KEV since 2025 · listed over a year |
| 1124 | CVE-2025-13223Google — Google Chromium V8 Type Confusion VulnerabilityCISA federal deadline · Overdue by 10 months | 75 | 8.8 | 4.9% · 92.1st | 2025-11-19 | 2025-12-10CISA federal deadline · Overdue by 10 months |
| 1125 | CVE-2020-1631Juniper — Juniper Junos OS Path Traversal VulnerabilityKEV since 2022 · listed over a year | 75 | 9.8 | 4.9% · 92nd | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.