Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 176 | CVE-2024-9463Palo Alto Networks — Palo Alto Networks Expedition OS Command Injection VulnerabilityExigentKEV since 2024 · listed over a year | 88 | 9.9 | 98.5% · 99.92nd | 2024-11-14 | 2024-12-05KEV since 2024 · listed over a year |
| 177 | CVE-2024-50603Aviatrix — Aviatrix Controllers OS Command Injection VulnerabilityExigentKEV since 2025 · listed over a year | 88 | 9.8 | 98.5% · 99.92nd | 2025-01-16 | 2025-02-06KEV since 2025 · listed over a year |
| 178 | CVE-2018-19410Paessler — Paessler PRTG Network Monitor Local File Inclusion VulnerabilityExigentKEV since 2025 · listed over a year | 88 | 9.8 | 97.9% · 99.91st | 2025-02-04 | 2025-02-25KEV since 2025 · listed over a year |
| 179 | CVE-2025-20281Cisco — Cisco Identity Services Engine Injection VulnerabilityExigentKEV since 2025 · listed over a year | 88 | 10.0 | 97.6% · 99.9th | 2025-07-28 | 2025-08-18KEV since 2025 · listed over a year |
| 180 | CVE-2023-52163Digiever — Digiever DS-2105 Pro Missing Authorization VulnerabilityCISA federal deadline · Overdue by 9 months | 88 | 8.8 | 96.9% · 99.89th | 2025-12-22 | 2026-01-12CISA federal deadline · Overdue by 9 months |
| 181 | CVE-2025-54068Laravel — Laravel Livewire Code Injection VulnerabilityExigentCISA federal deadline · Overdue by 7 months | 88 | 9.2 | 96.3% · 99.88th | 2026-03-20 | 2026-04-03CISA federal deadline · Overdue by 7 months |
| 182 | CVE-2025-12480Gladinet — Gladinet Triofox Improper Access Control VulnerabilityExigentCISA federal deadline · Overdue by 11 months | 88 | 9.1 | 95.7% · 99.87th | 2025-11-12 | 2025-12-03CISA federal deadline · Overdue by 11 months |
| 183 | CVE-2026-35616Fortinet — Fortinet FortiClient EMS Improper Access Control VulnerabilityExigentCISA federal deadline · Overdue by 6 months | 88 | 9.8 | 94.0% · 99.85th | 2026-04-06 | 2026-04-09CISA federal deadline · Overdue by 6 months |
| 184 | CVE-2025-11953React Native Community — React Native Community CLI OS Command Injection VulnerabilityExigentCISA federal deadline · Overdue by 8 months | 88 | 9.8 | 94.0% · 99.85th | 2026-02-05 | 2026-02-26CISA federal deadline · Overdue by 8 months |
| 185 | CVE-2026-21643Fortinet — Fortinet FortiClient EMS SQL Injection VulnerabilityExigentCISA federal deadline · Overdue by 6 months | 88 | 9.8 | 93.9% · 99.85th | 2026-04-13 | 2026-04-16CISA federal deadline · Overdue by 6 months |
| 186 | CVE-2025-64446Fortinet — Fortinet FortiWeb Path Traversal VulnerabilityExigentCISA federal deadline · Overdue by 11 months | 88 | 9.8 | 92.0% · 99.82nd | 2025-11-14 | 2025-11-21CISA federal deadline · Overdue by 11 months |
| 187 | CVE-2024-7399Samsung — Samsung MagicINFO 9 Server Path Traversal VulnerabilityExigentCISA federal deadline · Overdue by 5 months | 88 | 9.8 | 91.9% · 99.82nd | 2026-04-24 | 2026-05-08CISA federal deadline · Overdue by 5 months |
| 188 | CVE-2026-20182Cisco — Cisco Catalyst SD-WAN Controller Authentication Bypass VulnerabilityExigentCISA federal deadline · Overdue by 5 months | 88 | 10.0 | 91.8% · 99.82nd | 2026-05-14 | 2026-05-17CISA federal deadline · Overdue by 5 months |
| 189 | CVE-2018-15982Adobe — Adobe Flash Player Use-After-Free VulnerabilityRansomwareKEV since 2022 · listed over a year | 88 | 7.8 | 89.6% · 99.79th | 2022-02-15 | 2022-08-15KEV since 2022 · listed over a year |
| 190 | CVE-2018-4878Adobe — Adobe Flash Player Use-After-Free VulnerabilityRansomwareKEV since 2021 · listed over a year | 88 | 7.8 | 89.5% · 99.79th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 191 | CVE-2010-0188Adobe — Adobe Reader and Acrobat Arbitrary Code Execution VulnerabilityRansomwareKEV since 2022 · listed over a year | 88 | 7.8 | 88.2% · 99.77th | 2022-03-03 | 2022-03-24KEV since 2022 · listed over a year |
| 192 | CVE-2021-28799QNAP — QNAP NAS Improper Authorization VulnerabilityRansomwareExigentKEV since 2022 · listed over a year | 88 | 9.8 | 78.2% · 99.58th | 2022-03-31 | 2022-04-21KEV since 2022 · listed over a year |
| 193 | CVE-2017-11357Telerik — Telerik UI for ASP.NET AJAX Insecure Direct Object Reference VulnerabilityRansomwareExigentKEV since 2023 · listed over a year | 88 | 9.8 | 77.7% · 99.57th | 2023-01-26 | 2023-02-16KEV since 2023 · listed over a year |
| 194 | CVE-2024-57726SimpleHelp — SimpleHelp Missing Authorization VulnerabilityRansomwareExigentCISA federal deadline · Overdue by 5 months | 88 | 9.9 | 66.4% · 99.28th | 2026-04-24 | 2026-05-08CISA federal deadline · Overdue by 5 months |
| 195 | CVE-2014-6271GNU — GNU Bourne-Again Shell (Bash) Arbitrary Code Execution VulnerabilityExigentKEV since 2022 · listed over a year | 87 | 9.8 | 100.0% · 99.99th | 2022-01-28 | 2022-07-28KEV since 2022 · listed over a year |
| 196 | CVE-2017-9841PHPUnit — PHPUnit Command Injection VulnerabilityExigentKEV since 2022 · listed over a year | 87 | 9.8 | 100.0% · 99.99th | 2022-02-15 | 2022-08-15KEV since 2022 · listed over a year |
| 197 | CVE-2021-1498Cisco — Cisco HyperFlex HX Data Platform Command Injection VulnerabilityExigentKEV since 2021 · listed over a year | 87 | 9.8 | 100.0% · 99.99th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 198 | CVE-2023-1671Sophos — Sophos Web Appliance Command Injection VulnerabilityExigentKEV since 2023 · listed over a year | 87 | 9.8 | 100.0% · 99.99th | 2023-11-16 | 2023-12-07KEV since 2023 · listed over a year |
| 199 | CVE-2024-7593Ivanti — Ivanti Virtual Traffic Manager Authentication Bypass VulnerabilityExigentKEV since 2024 · listed over a year | 87 | 9.8 | 100.0% · 99.99th | 2024-09-24 | 2024-10-15KEV since 2024 · listed over a year |
| 200 | CVE-2012-1823PHP — PHP-CGI Query String Parameter VulnerabilityExigentKEV since 2022 · listed over a year | 87 | 9.8 | 100.0% · 99.99th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.