Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 151 | CVE-2026-24061GNU — GNU InetUtils Argument Injection VulnerabilityExigentCISA federal deadline · Overdue by 8 months | 89 | 9.8 | 99.0% · 99.93rd | 2026-01-26 | 2026-02-16CISA federal deadline · Overdue by 8 months |
| 152 | CVE-2026-1281Ivanti — Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityExigentCISA federal deadline · Overdue by 9 months | 89 | 9.8 | 98.7% · 99.92nd | 2026-01-29 | 2026-02-01CISA federal deadline · Overdue by 9 months |
| 153 | CVE-2026-1340Ivanti — Ivanti Endpoint Manager Mobile (EPMM) Code Injection VulnerabilityExigentCISA federal deadline · Overdue by 6 months | 89 | 9.8 | 98.6% · 99.92nd | 2026-04-08 | 2026-04-11CISA federal deadline · Overdue by 6 months |
| 154 | CVE-2026-20253Splunk — Splunk Enterprise Missing Authentication for Critical Function VulnerabilityExigentCISA federal deadline · Overdue by 4 months | 89 | 9.8 | 96.9% · 99.89th | 2026-06-18 | 2026-06-21CISA federal deadline · Overdue by 4 months |
| 155 | CVE-2022-36537ZK Framework — ZK Framework AuUploader Unspecified VulnerabilityRansomwareKEV since 2023 · listed over a year | 89 | 7.5 | 95.4% · 99.87th | 2023-02-27 | 2023-03-20KEV since 2023 · listed over a year |
| 156 | CVE-2024-9474Palo Alto Networks — Palo Alto Networks PAN-OS Management Interface OS Command Injection VulnerabilityRansomwareKEV since 2024 · listed over a year | 89 | 6.9 | 94.8% · 99.86th | 2024-11-18 | 2024-12-09KEV since 2024 · listed over a year |
| 157 | CVE-2022-27924Synacor — Synacor Zimbra Collaboration Suite (ZCS) Command Injection VulnerabilityRansomwareKEV since 2022 · listed over a year | 89 | 7.5 | 93.9% · 99.85th | 2022-08-04 | 2022-08-25KEV since 2022 · listed over a year |
| 158 | CVE-2026-20079Cisco — Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel VulnerabilityCISA federal deadline · Overdue by 40 days | 89 | 10.0 | 88.5% · 99.77th | 2026-09-09 | 2026-09-12CISA federal deadline · Overdue by 40 days |
| 159 | CVE-2026-71362Adobe — Adobe Commerce and Magento Incorrect Authorization VulnerabilityCISA federal deadline · Overdue by 25 days | 89 | 9.1 | 87.5% · 99.76th | 2026-09-24 | 2026-09-27CISA federal deadline · Overdue by 25 days |
| 160 | CVE-2024-21762Fortinet — Fortinet FortiOS Out-of-Bound Write VulnerabilityRansomwareExigentKEV since 2024 · listed over a year | 89 | 9.8 | 83.4% · 99.68th | 2024-02-09 | 2024-02-16KEV since 2024 · listed over a year |
| 161 | CVE-2020-3992VMware — VMware ESXi OpenSLP Use-After-Free VulnerabilityRansomwareExigentKEV since 2021 · listed over a year | 89 | 9.8 | 83.0% · 99.68th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 162 | CVE-2019-7194QNAP — QNAP Photo Station Path Traversal VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 89 | 9.8 | 82.7% · 99.67th | 2022-06-08 | 2022-06-22KEV since 2022 · listed over a year |
| 163 | CVE-2023-43208NextGen Healthcare — NextGen Healthcare Mirth Connect Deserialization of Untrusted Data VulnerabilityRansomwareExigentKEV since 2024 · listed over a year | 89 | 9.8 | 82.7% · 99.67th | 2024-05-20 | 2024-06-10KEV since 2024 · listed over a year |
| 164 | CVE-2018-6789Exim — Exim Buffer Overflow VulnerabilityRansomwareExigentKEV since 2021 · listed over a year | 89 | 9.8 | 82.1% · 99.66th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 165 | CVE-2021-26085Atlassian — Atlassian Confluence Server Pre-Authorization Arbitrary File Read VulnerabilityRansomwareKEV since 2022 · listed over a year | 88 | 5.3 | 99.9% · 99.97th | 2022-03-28 | 2022-04-18KEV since 2022 · listed over a year |
| 166 | CVE-2025-24813Apache — Apache Tomcat Path Equivalence VulnerabilityExigentKEV since 2025 · listed over a year | 88 | 9.8 | 99.9% · 99.97th | 2025-04-01 | 2025-04-22KEV since 2025 · listed over a year |
| 167 | CVE-2025-25257Fortinet — Fortinet FortiWeb SQL Injection VulnerabilityExigentKEV since 2025 · listed over a year | 88 | 9.8 | 99.9% · 99.97th | 2025-07-18 | 2025-08-08KEV since 2025 · listed over a year |
| 168 | CVE-2016-10033PHP — PHPMailer Command Injection VulnerabilityExigentKEV since 2025 · listed over a year | 88 | 9.8 | 99.7% · 99.95th | 2025-07-07 | 2025-07-28KEV since 2025 · listed over a year |
| 169 | CVE-2017-1000353Jenkins — Jenkins Remote Code Execution VulnerabilityExigentKEV since 2025 · listed over a year | 88 | 9.8 | 99.7% · 99.95th | 2025-10-02 | 2025-10-23KEV since 2025 · listed over a year |
| 170 | CVE-2021-32030ASUS — ASUS Routers Improper Authentication VulnerabilityExigentKEV since 2025 · listed over a year | 88 | 9.8 | 99.4% · 99.94th | 2025-06-02 | 2025-06-23KEV since 2025 · listed over a year |
| 171 | CVE-2024-4885Progress — Progress WhatsUp Gold Path Traversal VulnerabilityExigentKEV since 2025 · listed over a year | 88 | 9.8 | 99.3% · 99.94th | 2025-03-03 | 2025-03-24KEV since 2025 · listed over a year |
| 172 | CVE-2019-16278Nostromo — Nostromo nhttpd Directory Traversal VulnerabilityExigentKEV since 2024 · listed over a year | 88 | 9.8 | 99.0% · 99.93rd | 2024-11-07 | 2024-11-28KEV since 2024 · listed over a year |
| 173 | CVE-2025-68613n8n — n8n Improper Control of Dynamically-Managed Code Resources VulnerabilityCISA federal deadline · Overdue by 7 months | 88 | 8.8 | 99.0% · 99.93rd | 2026-03-11 | 2026-03-25CISA federal deadline · Overdue by 7 months |
| 174 | CVE-2025-49113Roundcube — RoundCube Webmail Deserialization of Untrusted Data VulnerabilityCISA federal deadline · Overdue by 7 months | 88 | 8.8 | 99.0% · 99.93rd | 2026-02-20 | 2026-03-13CISA federal deadline · Overdue by 7 months |
| 175 | CVE-2025-32433Erlang — Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function VulnerabilityExigentKEV since 2025 · listed over a year | 88 | 10.0 | 98.8% · 99.93rd | 2025-06-09 | 2025-06-30KEV since 2025 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.