Patch first, page 17
As of , all 1,734 vulnerabilities on CISA's list of exploited vulnerabilities, in our patch-first order: 101 to patch now.
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1601 | CVE-2020-9818Out-of-Bounds Write | Apple iOS, iPadOS, and watchOS | Patch soon | 0.02 | ||
| 1602 | CVE-2021-1782Race Condition | Apple Multiple Products | Patch soon | 0.02 | ||
| 1603 | CVE-2026-34621Prototype Pollution | Adobe Acrobat and Reader | Patch soon | 0.02 | ||
| 1604 | CVE-2025-21043Out-of-Bounds Write | Samsung Mobile Devices | Patch soon | 0.02 | ||
| 1605 | CVE-2025-32709Ancillary Function Driver for WinSock Use-After-Free | Microsoft Windows | Patch soon | 0.02 | ||
| 1606 | CVE-2017-6663IOS Software and Cisco IOS XE Software Denial-of-Service | Cisco IOS and IOS XE Software | Patch soon | 0.02 | ||
| 1607 | CVE-2017-12232for Cisco Integrated Services Routers Denial-of-Service | Cisco IOS software | Patch soon | 0.02 | ||
| 1608 | CVE-2020-9819Memory Corruption | Apple iOS, iPadOS, and watchOS | Patch soon | 0.02 | ||
| 1609 | CVE-2026-45247Deserialization of Untrusted Data | Mirasvit Mirasvit Full Page Cache Warmer | Patch soon | 0.02 | ||
| 1610 | CVE-2025-24984NTFS Information Disclosure | Microsoft Windows | Patch soon | 0.02 | ||
| 1611 | CVE-2025-24991NTFS Out-Of-Bounds Read | Microsoft Windows | Patch soon | 0.02 | ||
| 1612 | CVE-2025-0111File Read | Palo Alto Networks PAN-OS | Patch soon | 0.02 | ||
| 1613 | CVE-2023-6448Insecure Default Password | Unitronics Vision PLC and HMI | Patch soon | 0.02 | ||
| 1614 | CVE-2017-12238VPLS Denial-of-Service | Cisco Catalyst 6800 Series Switches | Patch soon | 0.02 | ||
| 1615 | CVE-2026-28318Uncontrolled Resource Consumption | SolarWinds Serv-U | Patch soon | 0.02 | ||
| 1616 | CVE-2023-41974Use-After-Free | Apple iOS and iPadOS | Patch soon | 0.02 | ||
| 1617 | CVE-2025-30400DWM Core Library Use-After-Free | Microsoft Windows | Patch soon | 0.02 | ||
| 1618 | CVE-2020-2506QNAP Helpdesk Improper Access Control | QNAP Systems Helpdesk | Patch soon | 0.02 | ||
| 1619 | CVE-2025-59689Command Injection | Libraesva Email Security Gateway | Patch soon | 0.02 | ||
| 1620 | CVE-2025-8875Insecure Deserialization | N-able N-Central | Patch soon | 0.02 | ||
| 1621 | CVE-2025-27920Directory Traversal | Srimax Output Messenger | Patch soon | 0.02 | ||
| 1622 | CVE-2019-0797Privilege Escalation | Microsoft Win32k | Patch soon | 0.02 | ||
| 1623 | CVE-2026-34909Path Traversal | Ubiquiti UniFi OS | Patch soon | 0.02 | ||
| 1624 | CVE-2024-7694Unrestricted Upload of File with Dangerous Type | TeamT5 ThreatSonar Anti-Ransomware | Patch soon | 0.02 | ||
| 1625 | CVE-2025-15556Download of Code Without Integrity Check | Notepad++ Notepad++ | Patch soon | 0.02 | ||
| 1626 | CVE-2025-21590Improper Isolation or Compartmentalization | Juniper Junos OS | Patch soon | 0.02 | ||
| 1627 | CVE-2025-22226Information Disclosure | VMware ESXi, Workstation, and Fusion | Patch soon | 0.02 | ||
| 1628 | CVE-2026-72530Code Injection | TrueConf Server | Patch soon | 0.02 | ||
| 1629 | CVE-2025-48595Integer Overflow | Android Framework | Patch soon | 0.02 | ||
| 1630 | CVE-2025-48700Cross-site Scripting | Synacor Zimbra Collaboration Suite (ZCS) | Patch soon | 0.02 | ||
| 1631 | CVE-2026-33634Embedded Malicious Code | Aquasecurity Trivy | Patch soon | 0.02 | ||
| 1632 | CVE-2024-21287Incorrect Authorization | Oracle Agile Product Lifecycle Management (PLM) | Patch soon | 0.02 | ||
| 1633 | CVE-2024-39891Information Disclosure | Twilio Authy | Patch soon | 0.02 | ||
| 1634 | CVE-2023-28229Privilege Escalation | Microsoft Windows CNG Key Isolation Service | Patch soon | 0.02 | ||
| 1635 | CVE-2022-41033Privilege Escalation | Microsoft Windows COM+ Event System Service | Patch soon | 0.02 | ||
| 1636 | CVE-2026-33824Double Free | Microsoft Internet Key Exchange (IKE) Service Extensions | Patch soon | 0.02 | ||
| 1637 | CVE-2025-31277Buffer Overflow | Apple Multiple Products | Patch soon | 0.02 | ||
| 1638 | CVE-2025-24989Improper Access Control | Microsoft Power Pages | Patch soon | 0.02 | ||
| 1639 | CVE-2024-38107Power Dependency Coordinator Privilege Escalation | Microsoft Windows | Patch soon | 0.02 | ||
| 1640 | CVE-2020-11261Multiple Chipsets Improper Input Validation | Qualcomm Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | Patch soon | 0.02 | ||
| 1641 | CVE-2026-67277Missing Authentication for Critical Function | MikroTik RouterOS | Patch soon | 0.02 | ||
| 1642 | CVE-2026-21514Word Reliance on Untrusted Inputs in a Security Decision | Microsoft Office | Patch soon | 0.02 | ||
| 1643 | CVE-2025-22224TOCTOU Race Condition | VMware ESXi and Workstation | Patch soon | 0.02 | ||
| 1644 | CVE-2025-21418Ancillary Function Driver for WinSock Heap-Based Buffer Overflow | Microsoft Windows | Patch soon | 0.02 | ||
| 1645 | CVE-2025-21334Hyper-V NT Kernel Integration VSP Use-After-Free | Microsoft Windows | Patch soon | 0.02 | ||
| 1646 | CVE-2019-8720Memory Corruption | WebKitGTK WebKitGTK | Patch soon | 0.02 | ||
| 1647 | CVE-2021-40450Privilege Escalation | Microsoft Win32k | Patch soon | 0.02 | ||
| 1648 | CVE-2021-41357Privilege Escalation | Microsoft Win32k | Patch soon | 0.02 | ||
| 1649 | CVE-2021-1905Use-After-Free | Qualcomm Multiple Chipsets | Patch soon | 0.02 | ||
| 1650 | CVE-2024-23225Memory Corruption | Apple Multiple Products | Patch soon | 0.01 | ||
| 1651 | CVE-2013-2597Stack-based Buffer Overflow | Code Aurora ACDB Audio Driver | Patch soon | 0.02 | ||
| 1652 | CVE-2021-36742Multiple Products Improper Input Validation | Trend Micro Apex One, Apex One as a Service, and Worry-Free Business Security | Patch soon | 0.01 | ||
| 1653 | CVE-2023-20963Privilege Escalation | Android Framework | Patch soon | 0.01 | ||
| 1654 | CVE-2026-20700Multiple Buffer Overflow | Apple Multiple Products | Patch soon | 0.01 | ||
| 1655 | CVE-2025-32701Common Log File System (CLFS) Driver Use-After-Free | Microsoft Windows | Patch soon | 0.01 | ||
| 1656 | CVE-2025-24983Win32k Use-After-Free | Microsoft Windows | Patch soon | 0.01 | ||
| 1657 | CVE-2025-21335Hyper-V NT Kernel Integration VSP Use-After-Free | Microsoft Windows | Patch soon | 0.01 | ||
| 1658 | CVE-2024-23296Memory Corruption | Apple Multiple Products | Patch soon | 0.01 | ||
| 1659 | CVE-2023-41990Code Execution | Apple Multiple Products | Patch soon | 0.01 | ||
| 1660 | CVE-2019-1214Privilege Common Log File System (CLFS) Escalation | Microsoft Windows | Patch soon | 0.01 | ||
| 1661 | CVE-2020-0069Insufficient Input Validation | MediaTek Multiple Chipsets | Patch soon | 0.01 | ||
| 1662 | CVE-2025-35939External Control of Assumed-Immutable Web Parameter | Craft CMS Craft CMS | Patch soon | 0.01 | ||
| 1663 | CVE-2024-53150Out-of-Bounds Read | Linux Kernel | Patch soon | 0.01 | ||
| 1664 | CVE-2023-4346Overly Restrictive Account Lockout Mechanism | KNX Association KNX Protocol Connection Authorization Option 1 | Patch soon | 0.01 | ||
| 1665 | CVE-2025-38352Time-of-Check Time-of-Use (TOCTOU) Race Condition | Linux Kernel | Patch soon | 0.01 | ||
| 1666 | CVE-2024-49035Improper Access Control | Microsoft Partner Center | Patch soon | 0.01 | ||
| 1667 | CVE-2026-45498Denial of Service | Microsoft Defender | Patch soon | 0.01 | ||
| 1668 | CVE-2026-21385Memory Corruption | Qualcomm Multiple Chipsets | Patch soon | 0.01 | ||
| 1669 | CVE-2025-59374Embedded Malicious Code | ASUS Live Update | Patch soon | 0.01 | ||
| 1670 | CVE-2023-26083Mali GPU Kernel Driver Information Disclosure | Arm Mali Graphics Processing Unit (GPU) | Patch soon | 0.01 | ||
| 1671 | CVE-2025-43200Unspecified | Apple Multiple Products | Patch soon | 0.01 | ||
| 1672 | CVE-2023-36851SRX Series Missing Authentication for Critical Function | Juniper Junos OS | Patch soon | 0.01 | ||
| 1673 | CVE-2022-22674Out-of-Bounds Read | Apple macOS | Patch soon | 0.01 | ||
| 1674 | CVE-2023-42824Kernel Privilege Escalation | Apple iOS and iPadOS | Patch soon | 0.01 | ||
| 1675 | CVE-2023-4211Use-After-Free | Arm Mali GPU Kernel Driver | Patch soon | 0.01 | ||
| 1676 | CVE-2022-22706Mali GPU Kernel Driver Unspecified | Arm Mali Graphics Processing Unit (GPU) | Patch soon | 0.01 | ||
| 1677 | CVE-2021-25369Improper Access Control | Samsung Mobile Devices | Patch soon | 0.01 | ||
| 1678 | CVE-2022-42827Out-of-Bounds Write | Apple iOS and iPadOS | Patch soon | 0.01 | ||
| 1679 | CVE-2026-3910Improper Restriction of Operations Within the Bounds of a Memory Buffer | Google Chromium V8 | Patch soon | 0.01 | ||
| 1680 | CVE-2025-27038Use-After-Free | Qualcomm Multiple Chipsets | Patch soon | 0.01 | ||
| 1681 | CVE-2021-23874Improper Privilege Management | McAfee McAfee Total Protection (MTP) | Patch soon | 0.01 | ||
| 1682 | CVE-2026-8452Improper Restriction of Operations within the Bounds of a Memory Buffer | Citrix NetScaler ADC and NetScaler Gateway | Patch soon | 0.01 | ||
| 1683 | CVE-2026-20349Heap Inspection | Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) | Patch soon | 0.01 | ||
| 1684 | CVE-2026-48172Privilege Escalation | LiteSpeed cPanel Plugin | Patch soon | 0.01 | ||
| 1685 | CVE-2021-1048Use-After-Free | Android Kernel | Patch soon | 0.01 | ||
| 1686 | CVE-2026-8398Embedded Malicious Code | Daemon Daemon Tools Lite | Patch soon | 0.01 | ||
| 1687 | CVE-2021-25370Memory Corruption | Samsung Mobile Devices | Patch soon | 0.01 | ||
| 1688 | CVE-2021-44168Arbitrary File Download | Fortinet FortiOS | Patch soon | 0.01 | ||
| 1689 | CVE-2026-59822Improper Authentication | BerriAI LiteLLM | Patch soon | 0.01 | ||
| 1690 | CVE-2025-21479Incorrect Authorization | Qualcomm Multiple Chipsets | Patch soon | 0.01 | ||
| 1691 | CVE-2020-9859Code Execution | Apple Multiple Products | Patch soon | 0.01 | ||
| 1692 | CVE-2026-54420UNIX Symbolic Link (Symlink) Following | LiteSpeed cPanel Plugin | Patch soon | 0.01 | ||
| 1693 | CVE-2024-50302Use of Uninitialized Resource | Linux Kernel | Patch soon | 0.01 | ||
| 1694 | CVE-2021-25371Unspecified | Samsung Mobile Devices | Patch soon | 0.01 | ||
| 1695 | CVE-2021-25372Improper Boundary Check | Samsung Mobile Devices | Patch soon | 0.01 | ||
| 1696 | CVE-2021-0920Race Condition | Android Kernel | Patch soon | 0.01 | ||
| 1697 | CVE-2023-33106Use of Out-of-Range Pointer Offset | Qualcomm Multiple Chipsets | Patch soon | 0.01 | ||
| 1698 | CVE-2024-4610Use-After-Free | Arm Mali GPU Kernel Driver | Patch soon | 0.01 | ||
| 1699 | CVE-2023-33107Integer Overflow | Qualcomm Multiple Chipsets | Patch soon | 0.01 | ||
| 1700 | CVE-2026-5281Use-After-Free | Google Dawn | Patch soon | 0.01 |