Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 126 | CVE-2019-7195QNAP — QNAP Photo Station Path Traversal VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 91 | 9.8 | 89.7% · 99.79th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 127 | CVE-2021-20021SonicWall — SonicWall Email Security Improper Privilege Management VulnerabilityRansomwareExigentKEV since 2021 · listed over a year | 91 | 9.8 | 88.8% · 99.78th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 128 | CVE-2023-41265Qlik — Qlik Sense HTTP Tunneling VulnerabilityRansomwareExigentKEV since 2023 · listed over a year | 91 | 9.9 | 88.2% · 99.77th | 2023-12-07 | 2023-12-28KEV since 2023 · listed over a year |
| 129 | CVE-2019-7192QNAP — QNAP Photo Station Improper Access Control VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 91 | 9.8 | 88.1% · 99.77th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 130 | CVE-2024-51567CyberPersons — CyberPanel Incorrect Default Permissions VulnerabilityRansomwareExigentKEV since 2024 · listed over a year | 91 | 9.8 | 84.4% · 99.7th | 2024-11-07 | 2024-11-28KEV since 2024 · listed over a year |
| 131 | CVE-2023-0669Fortra — Fortra GoAnywhere MFT Remote Code Execution VulnerabilityRansomwareKEV since 2023 · listed over a year | 90 | 7.2 | 100.0% · 99.99th | 2023-02-10 | 2023-03-03KEV since 2023 · listed over a year |
| 132 | CVE-2017-7921Hikvision — Hikvision Multiple Products Improper Authentication VulnerabilityExigentCISA federal deadline · Overdue by 7 months | 90 | 9.8 | 100.0% · 99.99th | 2026-03-05 | 2026-03-26CISA federal deadline · Overdue by 7 months |
| 133 | CVE-2026-10520Ivanti — Ivanti Sentry OS Command Injection VulnerabilityExigentCISA federal deadline · Overdue by 4 months | 90 | 10.0 | 99.9% · 99.97th | 2026-06-11 | 2026-06-14CISA federal deadline · Overdue by 4 months |
| 134 | CVE-2025-24893XWiki — XWiki Platform Eval Injection VulnerabilityExigentCISA federal deadline · Overdue by 11 months | 90 | 9.8 | 99.9% · 99.96th | 2025-10-30 | 2025-11-20CISA federal deadline · Overdue by 11 months |
| 135 | CVE-2025-32432Craft CMS — Craft CMS Code Injection VulnerabilityExigentCISA federal deadline · Overdue by 7 months | 90 | 10.0 | 99.8% · 99.96th | 2026-03-20 | 2026-04-03CISA federal deadline · Overdue by 7 months |
| 136 | CVE-2015-5477ISC — ISC BIND Data Processing Errors VulnerabilityCISA federal deadline · Overdue by 11 days | 90 | 7.5 | 99.4% · 99.94th | 2026-10-08 | 2026-10-11CISA federal deadline · Overdue by 11 days |
| 137 | CVE-2022-30333RARLAB — RARLAB UnRAR Directory Traversal VulnerabilityRansomwareKEV since 2022 · listed over a year | 90 | 7.5 | 99.2% · 99.94th | 2022-08-09 | 2022-08-30KEV since 2022 · listed over a year |
| 138 | CVE-2022-27925Synacor — Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload VulnerabilityRansomwareKEV since 2022 · listed over a year | 90 | 7.2 | 98.7% · 99.92nd | 2022-08-11 | 2022-09-01KEV since 2022 · listed over a year |
| 139 | CVE-2019-11539Ivanti — Ivanti Pulse Connect Secure and Policy Secure Command Injection VulnerabilityRansomwareKEV since 2021 · listed over a year | 90 | 7.2 | 98.5% · 99.92nd | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 140 | CVE-2016-3081Apache — Apache Struts Command Injection VulnerabilityCISA federal deadline · Overdue by 11 days | 90 | 8.1 | 96.1% · 99.88th | 2026-10-08 | 2026-10-11CISA federal deadline · Overdue by 11 days |
| 141 | CVE-2018-20250RARLAB — WinRAR Absolute Path Traversal VulnerabilityRansomwareKEV since 2022 · listed over a year | 90 | 7.8 | 96.0% · 99.88th | 2022-02-15 | 2022-08-15KEV since 2022 · listed over a year |
| 142 | CVE-2021-4034Red Hat — Red Hat Polkit Out-of-Bounds Read and Write VulnerabilityRansomwareKEV since 2022 · listed over a year | 90 | 7.8 | 94.9% · 99.86th | 2022-06-27 | 2022-07-18KEV since 2022 · listed over a year |
| 143 | CVE-2026-85706GitLab — GitLab Community Edition and Enterprise Edition Path Traversal VulnerabilityExigentCISA federal deadline · Overdue by 38 days | 90 | 10.0 | 92.0% · 99.82nd | 2026-09-11 | 2026-09-14CISA federal deadline · Overdue by 38 days |
| 144 | CVE-2023-40044Progress — Progress WS_FTP Server Deserialization of Untrusted Data VulnerabilityRansomwareKEV since 2023 · listed over a year | 90 | 8.8 | 90.4% · 99.8th | 2023-10-05 | 2023-10-26KEV since 2023 · listed over a year |
| 145 | CVE-2022-27593QNAP — QNAP Photo Station Externally Controlled Reference VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 90 | 9.1 | 87.9% · 99.77th | 2022-09-08 | 2022-09-29KEV since 2022 · listed over a year |
| 146 | CVE-2017-18362Kaseya — Kaseya VSA SQL Injection VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 90 | 9.8 | 86.8% · 99.75th | 2022-05-24 | 2022-06-14KEV since 2022 · listed over a year |
| 147 | CVE-2019-16057D-Link — D-Link DNS-320 Remote Code Execution VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 90 | 9.8 | 86.5% · 99.74th | 2022-04-15 | 2022-05-06KEV since 2022 · listed over a year |
| 148 | CVE-2021-30116Kaseya — Kaseya Virtual System/Server Administrator (VSA) Information Disclosure VulnerabilityRansomwareExigentKEV since 2021 · listed over a year | 90 | 9.8 | 85.7% · 99.73rd | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 149 | CVE-2023-27997Fortinet — Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow VulnerabilityRansomwareExigentKEV since 2023 · listed over a year | 90 | 9.8 | 85.7% · 99.73rd | 2023-06-13 | 2023-07-04KEV since 2023 · listed over a year |
| 150 | CVE-2025-48703CWP — CWP Control Web Panel OS Command Injection VulnerabilityExigentCISA federal deadline · Overdue by 11 months | 89 | 9.0 | 99.7% · 99.95th | 2025-11-04 | 2025-11-25CISA federal deadline · Overdue by 11 months |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.