Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Other vendors in CISA KEV
1,364 non-Microsoft CVEs in the KEV catalog| # | CVE · title | EVRS ↓ | CVSS ↕ | EPSS ↕ | In KEV since ↕ | CISA deadline |
|---|---|---|---|---|---|---|
| 201 | CVE-2013-2251Apache — Apache Struts Improper Input Validation VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 100.0% · 99.99th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 202 | CVE-2020-14882Oracle — Oracle WebLogic Server Remote Code Execution VulnerabilityKEV since 2021 · listed over a year | 87 | 9.8 | 100.0% · 99.99th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 203 | CVE-2019-16920D-Link — D-Link Multiple Routers Command Injection VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 100.0% · 99.99th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 204 | CVE-2022-44877CWP — CWP Control Web Panel OS Command Injection VulnerabilityKEV since 2023 · listed over a year | 87 | 9.8 | 100.0% · 99.99th | 2023-01-17 | 2023-02-07KEV since 2023 · listed over a year |
| 205 | CVE-2024-3273D-Link — D-Link Multiple NAS Devices Command Injection VulnerabilityKEV since 2024 · listed over a year | 87 | 9.8 | 100.0% · 99.99th | 2024-04-11 | 2024-05-02KEV since 2024 · listed over a year |
| 206 | CVE-2024-34102Adobe — Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) VulnerabilityKEV since 2024 · listed over a year | 87 | 9.8 | 100.0% · 99.99th | 2024-07-17 | 2024-08-07KEV since 2024 · listed over a year |
| 207 | CVE-2020-8515DrayTek — Multiple DrayTek Vigor Routers Web Management Page VulnerabilityKEV since 2021 · listed over a year | 87 | 9.8 | 100.0% · 99.99th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 208 | CVE-2021-33044Dahua — Dahua IP Camera Authentication Bypass VulnerabilityKEV since 2024 · listed over a year | 87 | 9.8 | 100.0% · 99.98th | 2024-08-21 | 2024-09-11KEV since 2024 · listed over a year |
| 209 | CVE-2020-9054Zyxel — Zyxel Multiple NAS Devices OS Command Injection VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 100.0% · 99.98th | 2022-03-25 | 2022-04-15KEV since 2022 · listed over a year |
| 210 | CVE-2019-9670Synacor — Synacor Zimbra Collaboration Suite (ZCS) Improper Restriction of XML External Entity ReferenceKEV since 2022 · listed over a year | 87 | 9.8 | 100.0% · 99.98th | 2022-01-10 | 2022-07-10KEV since 2022 · listed over a year |
| 211 | CVE-2021-20090Arcadyan — Arcadyan Buffalo Firmware Path Traversal VulnerabilityKEV since 2021 · listed over a year | 87 | 9.8 | 100.0% · 99.98th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 212 | CVE-2014-8361Realtek — Realtek SDK Improper Input Validation VulnerabilityKEV since 2023 · listed over a year | 87 | 9.8 | 100.0% · 99.98th | 2023-09-18 | 2023-10-09KEV since 2023 · listed over a year |
| 213 | CVE-2020-25506D-Link — D-Link DNS-320 Device Command Injection VulnerabilityKEV since 2021 · listed over a year | 87 | 9.8 | 100.0% · 99.98th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 214 | CVE-2019-10149Exim — Exim Mail Transfer Agent (MTA) Improper Input ValidationKEV since 2022 · listed over a year | 87 | 9.8 | 100.0% · 99.98th | 2022-01-10 | 2022-07-10KEV since 2022 · listed over a year |
| 215 | CVE-2018-2628Oracle — Oracle WebLogic Server Unspecified VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 100.0% · 99.98th | 2022-09-08 | 2022-09-29KEV since 2022 · listed over a year |
| 216 | CVE-2024-38475Apache — Apache HTTP Server Improper Escaping of Output VulnerabilityKEV since 2025 · listed over a year | 87 | 9.1 | 100.0% · 99.98th | 2025-05-01 | 2025-05-22KEV since 2025 · listed over a year |
| 217 | CVE-2018-15961Adobe — Adobe ColdFusion Unrestricted File Upload VulnerabilityKEV since 2021 · listed over a year | 87 | 9.8 | 100.0% · 99.97th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 218 | CVE-2022-30525Zyxel — Zyxel Multiple Firewalls OS Command Injection VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 99.9% · 99.97th | 2022-05-16 | 2022-06-06KEV since 2022 · listed over a year |
| 219 | CVE-2020-10189Zoho — Zoho ManageEngine Desktop Central File Upload VulnerabilityKEV since 2021 · listed over a year | 87 | 9.8 | 99.9% · 99.97th | 2021-11-03 | 2022-05-03KEV since 2021 · listed over a year |
| 220 | CVE-2014-7169GNU — GNU Bourne-Again Shell (Bash) Arbitrary Code Execution VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 99.9% · 99.97th | 2022-01-28 | 2022-07-28KEV since 2022 · listed over a year |
| 221 | CVE-2022-22963VMware Tanzu — VMware Tanzu Spring Cloud Function Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 99.9% · 99.97th | 2022-08-25 | 2022-09-15KEV since 2022 · listed over a year |
| 222 | CVE-2021-1497Cisco — Cisco HyperFlex HX Installer Virtual Machine Command Injection VulnerabilityKEV since 2021 · listed over a year | 87 | 9.8 | 99.9% · 99.97th | 2021-11-03 | 2021-11-17KEV since 2021 · listed over a year |
| 223 | CVE-2022-35405Zoho — Zoho ManageEngine Multiple Products Remote Code Execution VulnerabilityKEV since 2022 · listed over a year | 87 | 9.8 | 99.9% · 99.97th | 2022-09-22 | 2022-10-13KEV since 2022 · listed over a year |
| 224 | CVE-2024-32113Apache — Apache OFBiz Path Traversal VulnerabilityKEV since 2024 · listed over a year | 87 | 9.8 | 99.9% · 99.97th | 2024-08-07 | 2024-08-28KEV since 2024 · listed over a year |
| 225 | CVE-2022-24816OSGeo — OSGeo GeoServer JAI-EXT Code Injection VulnerabilityKEV since 2024 · listed over a year | 87 | 10.0 | 99.9% · 99.97th | 2024-06-26 | 2024-07-17KEV since 2024 · listed over a year |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.