Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 1301 | CVE-2026-48172LiteSpeed — LiteSpeed cPanel Plugin Privilege Escalation VulnerabilityCISA federal deadline · Overdue by 5 months | 75 | 10.0 | 1.0% · 62.8th | 2026-05-26 | 2026-05-29CISA federal deadline · Overdue by 5 months |
| 1302 | CVE-2026-8452Citrix — Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCISA federal deadline · Overdue by 54 days | 75 | 8.8 | 1.0% · 62.8th | 2026-08-26 | 2026-08-29CISA federal deadline · Overdue by 54 days |
| 1303 | CVE-2026-20349Cisco — Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection VulnerabilityCISA federal deadline · Overdue by 2 months | 75 | 8.6 | 1.0% · 62.8th | 2026-08-11 | 2026-08-14CISA federal deadline · Overdue by 2 months |
| 1304 | CVE-2026-16812Arista — Arista VeloCloud Orchestrator On-Prem OS Command Injection VulnerabilityCISA federal deadline · Overdue by 3 months | 75 | 10.0 | 1.0% · 62.5th | 2026-07-27 | 2026-07-30CISA federal deadline · Overdue by 3 months |
| 1305 | CVE-2023-42824Apple — Apple iOS and iPadOS Kernel Privilege Escalation VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 1.0% · 61.6th | 2023-10-05 | 2023-10-26KEV since 2023 · listed over a year |
| 1306 | CVE-2026-8398Daemon — Daemon Tools Lite Embedded Malicious Code VulnerabilityCISA federal deadline · Overdue by 5 months | 75 | 9.3 | 1.0% · 61.3rd | 2026-05-27 | 2026-05-30CISA federal deadline · Overdue by 5 months |
| 1307 | CVE-2026-84869ConnectWise — ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization VulnerabilityCISA federal deadline · Overdue by 38 days | 75 | 9.9 | 0.9% · 60.1st | 2026-09-11 | 2026-09-14CISA federal deadline · Overdue by 38 days |
| 1308 | CVE-2021-25370Samsung — Samsung Mobile Devices Memory Corruption VulnerabilityKEV since 2022 · listed over a year | 75 | 4.4 | 0.9% · 59th | 2022-11-08 | 2022-11-29KEV since 2022 · listed over a year |
| 1309 | CVE-2026-55255Langflow — Langflow Authorization Bypass Through User-Controlled Key VulnerabilityCISA federal deadline · Overdue by 3 months | 75 | 8.4 | 0.9% · 58.9th | 2026-07-07 | 2026-07-10CISA federal deadline · Overdue by 3 months |
| 1310 | CVE-2021-0920Android — Android Kernel Race Condition VulnerabilityKEV since 2022 · listed over a year | 75 | 6.4 | 0.9% · 58.3rd | 2022-05-23 | 2022-06-13KEV since 2022 · listed over a year |
| 1311 | CVE-2021-44168Fortinet — Fortinet FortiOS Arbitrary File DownloadKEV since 2021 · listed over a year | 75 | 7.8 | 0.9% · 58.2nd | 2021-12-10 | 2021-12-24KEV since 2021 · listed over a year |
| 1312 | CVE-2025-21479Qualcomm — Qualcomm Multiple Chipsets Incorrect Authorization VulnerabilityKEV since 2025 · listed over a year | 75 | 8.6 | 0.8% · 57.5th | 2025-06-03 | 2025-06-24KEV since 2025 · listed over a year |
| 1313 | CVE-2026-59822BerriAI — BerriAI LiteLLM Improper Authentication VulnerabilityCISA federal deadline · Overdue by 36 days | 75 | 8.8 | 0.8% · 57.3rd | 2026-09-02 | 2026-09-16CISA federal deadline · Overdue by 36 days |
| 1314 | CVE-2020-9859Apple — Apple Multiple Products Code Execution VulnerabilityKEV since 2021 · listed over a year | 75 | 7.8 | 0.8% · 57.1st | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 1315 | CVE-2026-53266Linux — Linux Kernel Out-of-Bounds Write VulnerabilityCISA federal deadline · Overdue by 31 days | 75 | 8.8 | 0.8% · 57th | 2026-09-18 | 2026-09-21CISA federal deadline · Overdue by 31 days |
| 1316 | CVE-2026-96656Plex — Plex Media Server External Control of File Name or Path VulnerabilityCISA federal deadline in 1 day | 75 | 8.6 | 0.8% · 56.6th | 2026-10-20 | 2026-10-23CISA federal deadline in 1 day |
| 1317 | CVE-2026-46817Oracle — Oracle E-Business Suite Improper Privilege Management VulnerabilityCISA federal deadline · Overdue by 3 months | 75 | 9.8 | 0.8% · 56.6th | 2026-07-15 | 2026-07-18CISA federal deadline · Overdue by 3 months |
| 1318 | CVE-2024-50302Linux — Linux Kernel Use of Uninitialized Resource VulnerabilityKEV since 2025 · listed over a year | 75 | 5.5 | 0.8% · 56.5th | 2025-03-04 | 2025-03-25KEV since 2025 · listed over a year |
| 1319 | CVE-2026-54420LiteSpeed — LiteSpeed cPanel Plugin UNIX Symbolic Link (Symlink) Following VulnerabilityCISA federal deadline · Overdue by 4 months | 75 | 8.5 | 0.8% · 56.4th | 2026-06-15 | 2026-06-18CISA federal deadline · Overdue by 4 months |
| 1320 | CVE-2021-25372Samsung — Samsung Mobile Devices Improper Boundary Check VulnerabilityKEV since 2023 · listed over a year | 75 | 6.7 | 0.8% · 56.3rd | 2023-06-29 | 2023-07-20KEV since 2023 · listed over a year |
| 1321 | CVE-2021-25371Samsung — Samsung Mobile Devices Unspecified VulnerabilityKEV since 2023 · listed over a year | 75 | 6.7 | 0.8% · 56.2nd | 2023-06-29 | 2023-07-20KEV since 2023 · listed over a year |
| 1322 | CVE-2023-33106Qualcomm — Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 0.8% · 55.7th | 2023-12-05 | 2023-12-26KEV since 2023 · listed over a year |
| 1323 | CVE-2024-4610Arm — Arm Mali GPU Kernel Driver Use-After-Free VulnerabilityKEV since 2024 · listed over a year | 75 | 7.8 | 0.8% · 54.9th | 2024-06-12 | 2024-07-03KEV since 2024 · listed over a year |
| 1324 | CVE-2023-33107Qualcomm — Qualcomm Multiple Chipsets Integer Overflow VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 0.7% · 54th | 2023-12-05 | 2023-12-26KEV since 2023 · listed over a year |
| 1325 | CVE-2024-43093Android — Android Framework Privilege Escalation VulnerabilityKEV since 2024 · listed over a year | 75 | 7.3 | 0.7% · 53rd | 2024-11-07 | 2024-11-28KEV since 2024 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.