Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 1326 | CVE-2026-53362Linux — Linux Kernel Unspecified VulnerabilityCISA federal deadline · Overdue by 53 days | 75 | 7.8 | 0.7% · 52.9th | 2026-08-27 | 2026-08-30CISA federal deadline · Overdue by 53 days |
| 1327 | CVE-2026-5281Google — Google Dawn Use-After-Free VulnerabilityCISA federal deadline · Overdue by 6 months | 75 | 8.8 | 0.7% · 52.7th | 2026-04-01 | 2026-04-15CISA federal deadline · Overdue by 6 months |
| 1328 | CVE-2019-8526Apple — Apple macOS Use-After-Free VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 0.7% · 52.6th | 2023-04-17 | 2023-05-08KEV since 2023 · listed over a year |
| 1329 | CVE-2025-1976Broadcom — Broadcom Brocade Fabric OS Code Injection VulnerabilityKEV since 2025 · listed over a year | 75 | 8.6 | 0.7% · 52.2nd | 2025-04-28 | 2025-05-19KEV since 2025 · listed over a year |
| 1330 | CVE-2021-39793Google — Google Pixel Out-of-Bounds Write VulnerabilityKEV since 2022 · listed over a year | 75 | 7.8 | 0.7% · 52nd | 2022-04-11 | 2022-05-02KEV since 2022 · listed over a year |
| 1331 | CVE-2024-29748Android — Android Pixel Privilege Escalation VulnerabilityKEV since 2024 · listed over a year | 75 | 7.8 | 0.7% · 51.6th | 2024-04-04 | 2024-04-25KEV since 2024 · listed over a year |
| 1332 | CVE-2023-33063Qualcomm — Qualcomm Multiple Chipsets Use-After-Free VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 0.7% · 51.4th | 2023-12-05 | 2023-12-26KEV since 2023 · listed over a year |
| 1333 | CVE-2024-43047Qualcomm — Qualcomm Multiple Chipsets Use-After-Free VulnerabilityKEV since 2024 · listed over a year | 75 | 7.8 | 0.7% · 51.3rd | 2024-10-08 | 2024-10-29KEV since 2024 · listed over a year |
| 1334 | CVE-2026-66384JFrog — JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory VulnerabilityCISA federal deadline · Overdue by 42 days | 75 | 5.3 | 0.7% · 51.1st | 2026-08-27 | 2026-09-10CISA federal deadline · Overdue by 42 days |
| 1335 | CVE-2026-7473Arista — Arista Extensible Operating System Incomplete Comparison with Missing Factors VulnerabilityCISA federal deadline · Overdue by 4 months | 75 | 6.9 | 0.6% · 50.4th | 2026-06-09 | 2026-06-23CISA federal deadline · Overdue by 4 months |
| 1336 | CVE-2021-25487Samsung — Samsung Mobile Devices Out-of-Bounds Read VulnerabilityKEV since 2023 · listed over a year | 75 | 7.8 | 0.6% · 49.7th | 2023-06-29 | 2023-07-20KEV since 2023 · listed over a year |
| 1337 | CVE-2025-48543Android — Android Runtime Use-After-Free VulnerabilityKEV since 2025 · listed over a year | 75 | 8.8 | 0.6% · 49.7th | 2025-09-04 | 2025-09-25KEV since 2025 · listed over a year |
| 1338 | CVE-2026-88779Citrix — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer VulnerabilityCISA federal deadline · Overdue by 15 days | 75 | 8.7 | 0.6% · 47.5th | 2026-10-04 | 2026-10-07CISA federal deadline · Overdue by 15 days |
| 1339 | CVE-2026-58704Google — Google Pixel Improper Authorization VulnerabilityCISA federal deadline · Overdue by 33 days | 75 | 8.8 | 0.6% · 47.5th | 2026-09-16 | 2026-09-19CISA federal deadline · Overdue by 33 days |
| 1340 | CVE-2026-5430WSO2 — WSO2 Multiple Products Path Traversal VulnerabilityCISA federal deadline · Overdue by 25 days | 75 | 10.0 | 0.6% · 47.4th | 2026-09-24 | 2026-09-27CISA federal deadline · Overdue by 25 days |
| 1341 | CVE-2025-48928TeleMessage — TeleMessage TM SGNL Exposure of Core Dump File to an Unauthorized Control Sphere VulnerabilityKEV since 2025 · listed over a year | 75 | 4.0 | 0.6% · 45.4th | 2025-07-01 | 2025-07-22KEV since 2025 · listed over a year |
| 1342 | CVE-2026-102490Zammad GmbH — Zammad GmbH Zammad Improper Privilege Management VulnerabilityCISA federal deadline · Overdue by 17 days | 75 | 9.4 | 0.5% · 45.2nd | 2026-10-02 | 2026-10-05CISA federal deadline · Overdue by 17 days |
| 1343 | CVE-2026-34926Trend Micro — Trend Micro Apex One (On-Premise) Directory Traversal VulnerabilityCISA federal deadline · Overdue by 5 months | 75 | 6.7 | 0.5% · 44.4th | 2026-05-21 | 2026-06-04CISA federal deadline · Overdue by 5 months |
| 1344 | CVE-2021-25489Samsung — Samsung Mobile Devices Improper Input Validation VulnerabilityKEV since 2023 · listed over a year | 75 | 5.5 | 0.5% · 44th | 2023-06-29 | 2023-07-20KEV since 2023 · listed over a year |
| 1345 | CVE-2021-1906Qualcomm — Qualcomm Multiple Chipsets Detection of Error Condition Without Action VulnerabilityKEV since 2021 · listed over a year | 75 | 5.5 | 0.5% · 43.3rd | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 1346 | CVE-2022-48618Apple — Apple Multiple Products Memory Corruption VulnerabilityKEV since 2024 · listed over a year | 75 | 7.0 | 0.5% · 40.9th | 2024-01-31 | 2024-02-21KEV since 2024 · listed over a year |
| 1347 | CVE-2024-29745Android — Android Pixel Information Disclosure VulnerabilityKEV since 2024 · listed over a year | 75 | 5.5 | 0.5% · 40.9th | 2024-04-04 | 2024-04-25KEV since 2024 · listed over a year |
| 1348 | CVE-2025-21480Qualcomm — Qualcomm Multiple Chipsets Incorrect Authorization VulnerabilityKEV since 2025 · listed over a year | 75 | 8.6 | 0.5% · 38.8th | 2025-06-03 | 2025-06-24KEV since 2025 · listed over a year |
| 1349 | CVE-2025-47729TeleMessage — TeleMessage TM SGNL Hidden Functionality VulnerabilityKEV since 2025 · listed over a year | 75 | 4.9 | 0.4% · 37.8th | 2025-05-12 | 2025-06-02KEV since 2025 · listed over a year |
| 1350 | CVE-2026-96654Plex — Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page VulnerabilityCISA federal deadline in 1 day | 75 | 6.9 | 0.4% · 36.4th | 2026-10-20 | 2026-10-23CISA federal deadline in 1 day |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.