State now. Since yesterday: +2 tier promotions, 0 known-exploited vulnerability additions, 4 leak-site claims, and 4 confirmed breaches.
Why today matters ·
Vulnerabilities
Patch Day
Browse monthly Microsoft and cross-vendor patch records and their exploitation signals in stable, server-rendered pages.
Pick a month to see every Microsoft and cross-vendor patch record returned for it, with the exploitation signals that matter. Each month opens on stable, server-rendered pages.
Why now: November 2026 is the newest patch month in this site build.
134,505Patch Day records in this site build
16months in this site build
112,134records also tracked in the vulnerability table
October 2026busiest month in this site build
Validated coverage. All returned records from the validated Microsoft, Red Hat, Cisco, and Android exports are available in the built month pages. Ordinary next-page links work without JavaScript.
Vendors joined this archive over time, so a month's total leaves out any vendor that had not started yet. Records begin in February 2026 for Android and Cisco, March 2026 for Red Hat, April 2026 for SUSE, and May 2026 for Siemens. Compare months that share the same vendors.
Newest
4,130 recordsNovember 2026
Period: Month to date through 2026-11-06 02:52 UTCPre-release: out-of-band and Edge updates ahead of November 10226 critical severity0 exploitation detected (Microsoft)0 Microsoft records in KEV3,300 also in the vulnerability table
Red Hat 1,937SUSE 1,736Android 389Microsoft 67Cisco 1
Open November 2026 Busiest
35,169 recordsOctober 2026
3,257 critical severity1 exploitation detected (Microsoft)3 Microsoft records in KEV29,896 also in the vulnerability table
SUSE 16,679Red Hat 14,491Microsoft 3,487Siemens 404Cisco 77Android 31
Open October 2026 September 2026
1,428 critical severity2 exploitation detected (Microsoft)4 Microsoft records in KEV21,730 also in the vulnerability table
SUSE 12,088Red Hat 10,335Microsoft 2,989Android 284Cisco 98Siemens 17
Open September 2026 August 2026
2,443 critical severity1 exploitation detected (Microsoft)3 Microsoft records in KEV17,887 also in the vulnerability table
SUSE 11,413Red Hat 6,693Microsoft 2,861Cisco 46Siemens 17Android 1
Open August 2026 July 2026
784 critical severity3 exploitation detected (Microsoft)6 Microsoft records in KEV14,899 also in the vulnerability table
SUSE 9,164Red Hat 5,296Microsoft 2,162Siemens 195Cisco 16
Open July 2026 June 2026
880 critical severity0 exploitation detected (Microsoft)2 Microsoft records in KEV10,232 also in the vulnerability table
SUSE 6,111Red Hat 4,464Microsoft 1,285Android 140Siemens 30Cisco 10
Open June 2026 May 2026
313 critical severity3 exploitation detected (Microsoft)5 Microsoft records in KEV7,384 also in the vulnerability table
SUSE 4,090Red Hat 3,861Microsoft 1,132Siemens 121Cisco 19Android 1
Records begin: Siemens
Open May 2026 April 2026
144 critical severity2 exploitation detected (Microsoft)6 Microsoft records in KEV3,018 also in the vulnerability table
Red Hat 3,882Microsoft 739SUSE 125Cisco 31Android 5
Records begin: SUSE
Open April 2026 March 2026
79 critical severity0 exploitation detected (Microsoft)2 Microsoft records in KEV2,459 also in the vulnerability table
Red Hat 2,647Microsoft 463Android 136Cisco 69
Records begin: Red Hat
Open March 2026 February 2026
15 critical severity6 exploitation detected (Microsoft)7 Microsoft records in KEV120 also in the vulnerability table
Microsoft 173Cisco 20Android 1
Records begin: Android, Cisco
Open February 2026 January 2026
30 critical severity2 exploitation detected (Microsoft)3 Microsoft records in KEV202 also in the vulnerability table
Microsoft 327
Open January 2026 December 2025
15 critical severity1 exploitation detected (Microsoft)2 Microsoft records in KEV179 also in the vulnerability table
Microsoft 349
Open December 2025 November 2025
15 critical severity1 exploitation detected (Microsoft)3 Microsoft records in KEV122 also in the vulnerability table
Microsoft 184
Open November 2025 October 2025
41 critical severity3 exploitation detected (Microsoft)5 Microsoft records in KEV314 also in the vulnerability table
Microsoft 429
Open October 2025 September 2025
15 critical severity0 exploitation detected (Microsoft)3 Microsoft records in KEV211 also in the vulnerability table
Microsoft 401
Open September 2025 August 2025
21 critical severity0 exploitation detected (Microsoft)0 Microsoft records in KEV181 also in the vulnerability table
Microsoft 286
Open August 2025 Vendor coverage
What the archive covers, and why some vendors are absent.
- MicrosoftCoveredPatch Tuesday: the Microsoft Security Response Center monthly release, tracked in depth on this page.
- AndroidCoveredGoogle Android Security Bulletins via the OSV feed. The fix commit is the CVE-to-patch link; severity is Android's qualitative rating (no CVSS).
- CiscoCoveredCisco public CSAF 2.0 advisories: per-CVE CVSS, a Security Impact Rating, and vendor-fix remediation links.
- Red HatCoveredRed Hat CSAF 2.0 security advisories (RHSA/RHBA/RHEA): a per-CVE CVSS base score where the advisory publishes one (v3 or v4), else Red Hat's own document severity, plus vendor-fix remediation links. CC BY 4.0, attributed to Red Hat, Inc. 53606 of 53606 row(s) carry a link to the original advisory (a document that publishes no self reference carries none).
- SAPNo machine-readable feedSAP Security Patch Day notes list the CVEs, but the patch detail (the Note that maps a CVE to its fix) requires an S-user support login. No anonymous machine-readable CVE-to-patch mapping exists.
- AdobeNo machine-readable feedAdobe publishes security bulletins (APSB) as HTML pages only, with no structured feed and no machine-readable CVE-to-patch mapping.
- FortinetNo machine-readable feedFortiGuard PSIRT advisories are HTML and RSS only, with no CSAF or JSON feed carrying a machine-readable CVE-to-fixed-version mapping.
- IvantiNo machine-readable feedIvanti security advisories are HTML only, with no structured feed and no machine-readable CVE-to-patch mapping.
Cross-vendor sources and licences
- Android Google Android Security Bulletins (via OSV) via feedAdvisory data under the Android Open Source Project (Apache 2.0); OSV feed CC-BY 4.0.
- Cisco Cisco Security Advisories (CSAF 2.0)Cisco Security Vulnerability Policy; CSAF documents published credential-free.
- Red Hat Red Hat Security Data (CSAF 2.0 advisories)CC BY 4.0, per Red Hat's own CSAF document legal_disclaimer; requires attribution to Red Hat, Inc. and a link to the original advisory.
Full obligations and source details are on the attributions page.
How this is computed
The archive groups source-returned vendor patch records by month. Counts describe this site build, tracked totals identify records also present in the vulnerability table, and source obligations remain listed above.
Method reviewed on .