Vendor Advisories
Security advisories grouped by vendor from the CISA Known Exploited Vulnerabilities catalog. Filter by vendor, time window, or keyword.
Vendor Advisory Portals
Microsoft MSRC
Security Update Guide, Patch Tuesday, MSRC blog
Cisco PSIRT
Cisco Product Security Incident Response Team advisories
Fortinet PSIRT
FortiGate, FortiManager, FortiAnalyzer security advisories
Palo Alto Networks Security Advisories
Official PSIRT advisories — for threat research, see Unit 42 at unit42.paloaltonetworks.com
Ivanti Security
Connect Secure, Pulse, EPMM vulnerability advisories
VMware Security
vSphere, ESXi, Horizon, Workspace ONE advisories
Atlassian Security
Confluence, Jira, Bitbucket vulnerability advisories
Apache Security
Log4j, Struts, Tomcat and other Apache project advisories
CISA Advisories
US federal cybersecurity advisories and ICS-CERT notices
Related Vulnerability Research
Search 250,000+ CVEs from the NIST National Vulnerability Database. Live CVSS scores, CWE mappings and vendor references.
CVSS 3.1 base score calculator. Compute scores from attack vector, complexity, privileges, scope and impact metrics.
Exploit methodology reference: vulnerability classes, weaponisation lifecycle, PoC-to-exploit pipeline and detection opportunities.
Layered mitigation playbooks for RCE, SQLi, SSRF, Deserialization, Auth Bypass and XXE. WAF rules and compensating controls when patches can't deploy immediately.
Patch prioritisation framework: CVSS score, CISA KEV status, exploit availability and environmental context scoring.
Frequently Asked Questions
What is the CISA KEV catalog?
The Known Exploited Vulnerabilities catalog maintained by CISA — a list of CVEs confirmed to have been actively exploited in the wild, used to prioritise patching.
How is CISA KEV different from the full NVD?
NVD lists all known CVEs regardless of exploitation status; KEV is a much smaller, curated subset CISA has confirmed is being actively exploited, with mandated remediation deadlines for US federal agencies.
Do CISA KEV deadlines apply to private companies?
The binding deadlines (BOD 22-01) apply to US federal civilian agencies, but KEV listing is widely used by private organisations as a de facto "patch this first" signal.
How often is the KEV catalog updated?
CISA adds new entries on a rolling basis whenever a vulnerability meets its active-exploitation criteria, sometimes multiple times per week.