Every vulnerability CISA has confirmed as exploited in the wild. US federal agencies must remediate these by the due date; for everyone else it is the best-evidenced patch queue in the industry. Source: CISA, a public-domain US government work.