Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 101 | CVE-2024-21893Ivanti — Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) VulnerabilityRansomwareKEV since 2024 · listed over a year | 92 | 8.2 | 100.0% · 99.99th | 2024-01-31 | 2024-02-02KEV since 2024 · listed over a year |
| 102 | CVE-2023-46805Ivanti — Ivanti Connect Secure and Policy Secure Authentication Bypass VulnerabilityRansomwareKEV since 2024 · listed over a year | 92 | 8.2 | 100.0% · 99.98th | 2024-01-10 | 2024-01-22KEV since 2024 · listed over a year |
| 103 | CVE-2024-24919Check Point — Check Point Quantum Security Gateways Information Disclosure VulnerabilityRansomwareKEV since 2024 · listed over a year | 92 | 8.6 | 100.0% · 99.98th | 2024-05-30 | 2024-06-20KEV since 2024 · listed over a year |
| 104 | CVE-2019-11580Atlassian — Atlassian Crowd and Crowd Data Center Remote Code Execution VulnerabilityRansomwareExigentKEV since 2021 · listed over a year | 92 | 9.8 | 95.4% · 99.87th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 105 | CVE-2016-4117Adobe — Adobe Flash Player Arbitrary Code Execution VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 92 | 9.8 | 94.4% · 99.85th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 106 | CVE-2012-1723Oracle — Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 92 | 9.8 | 93.6% · 99.84th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 107 | CVE-2024-6670Progress — Progress WhatsUp Gold SQL Injection VulnerabilityRansomwareExigentKEV since 2024 · listed over a year | 92 | 9.8 | 93.0% · 99.83rd | 2024-09-16 | 2024-10-07KEV since 2024 · listed over a year |
| 108 | CVE-2022-37042Synacor — Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 92 | 9.8 | 91.9% · 99.82nd | 2022-08-11 | 2022-09-01KEV since 2022 · listed over a year |
| 109 | CVE-2018-11138Quest — Quest KACE System Management Appliance Remote Command Execution VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 92 | 9.8 | 91.7% · 99.82nd | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 110 | CVE-2021-35211SolarWinds — SolarWinds Serv-U Remote Code Execution VulnerabilityRansomwareExigentKEV since 2021 · listed over a year | 92 | 10.0 | 91.2% · 99.81st | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 111 | CVE-2026-50751Check Point — Check Point Security Gateway Improper Authentication VulnerabilityRansomwareExigentCISA federal deadline · Overdue by 4 months | 92 | 9.3 | 85.3% · 99.72nd | 2026-06-08 | 2026-06-11CISA federal deadline · Overdue by 4 months |
| 112 | CVE-2023-4966Citrix — Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow VulnerabilityRansomwareKEV since 2023 · listed over a year | 91 | 7.5 | 100.0% · 99.99th | 2023-10-18 | 2023-11-08KEV since 2023 · listed over a year |
| 113 | CVE-2017-10271Oracle — Oracle Corporation WebLogic Server Remote Code Execution VulnerabilityRansomwareKEV since 2022 · listed over a year | 91 | 7.5 | 100.0% · 99.99th | 2022-02-10 | 2022-08-10KEV since 2022 · listed over a year |
| 114 | CVE-2019-7481SonicWall — SonicWall SMA100 SQL Injection VulnerabilityRansomwareKEV since 2021 · listed over a year | 91 | 7.5 | 99.9% · 99.97th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 115 | CVE-2023-38831RARLAB — RARLAB WinRAR Code Execution VulnerabilityRansomwareKEV since 2023 · listed over a year | 91 | 7.8 | 99.8% · 99.96th | 2023-08-24 | 2023-09-14KEV since 2023 · listed over a year |
| 116 | CVE-2008-2992Adobe — Adobe Reader and Acrobat Input Validation VulnerabilityRansomwareKEV since 2022 · listed over a year | 91 | 7.8 | 99.8% · 99.96th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 117 | CVE-2017-12615Apache — Apache Tomcat on Windows Remote Code Execution VulnerabilityRansomwareKEV since 2022 · listed over a year | 91 | 8.1 | 99.6% · 99.95th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 118 | CVE-2026-72898Metabase — Metabase SQL Injection VulnerabilityExigentCISA federal deadline · Overdue by 2 months | 91 | 10.0 | 97.4% · 99.9th | 2026-08-11 | 2026-08-14CISA federal deadline · Overdue by 2 months |
| 119 | CVE-2024-57727SimpleHelp — SimpleHelp Path Traversal VulnerabilityRansomwareKEV since 2025 · listed over a year | 91 | 7.5 | 96.8% · 99.89th | 2025-02-13 | 2025-03-06KEV since 2025 · listed over a year |
| 120 | CVE-2025-61884Oracle — Oracle E-Business Suite Server-Side Request Forgery (SSRF) VulnerabilityRansomwareKEV since 2025 · listed over a year | 91 | 7.5 | 95.9% · 99.88th | 2025-10-20 | 2025-11-10KEV since 2025 · listed over a year |
| 121 | CVE-2017-9822DotNetNuke (DNN) — DotNetNuke (DNN) Remote Code Execution VulnerabilityRansomwareKEV since 2021 · listed over a year | 91 | 8.8 | 94.8% · 99.86th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 122 | CVE-2025-8088RARLAB — RARLAB WinRAR Path Traversal VulnerabilityRansomwareKEV since 2025 · listed over a year | 91 | 8.4 | 94.5% · 99.86th | 2025-08-12 | 2025-09-02KEV since 2025 · listed over a year |
| 123 | CVE-2022-26352dotCMS — dotCMS Unrestricted Upload of File VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 91 | 9.8 | 91.2% · 99.81st | 2022-08-25 | 2022-09-15KEV since 2022 · listed over a year |
| 124 | CVE-2017-12149Red Hat — Red Hat JBoss Application Server Remote Code Execution VulnerabilityRansomwareExigentKEV since 2021 · listed over a year | 91 | 9.8 | 90.7% · 99.81st | 2021-12-10 | 2022-06-10KEV since 2021 · listed over a year |
| 125 | CVE-2024-40711Veeam — Veeam Backup and Replication Deserialization VulnerabilityRansomwareExigentKEV since 2024 · listed over a year | 91 | 9.8 | 90.4% · 99.8th | 2024-10-17 | 2024-11-07KEV since 2024 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.