About Patch Bulletin
Where the data comes from
Patch Bulletin lists every vulnerability in CISA's Known Exploited Vulnerabilities catalog. Each page joins the KEV entry with severity from the National Vulnerability Database, exploitation probability from FIRST EPSS and affected versions from the CVE record. We refresh once a day. Each page shows when every source was last checked.
Method
- Fixed versions come only from explicit "unaffected" boundaries in the CVE record. We never infer a version.
- Severity uses the NVD CVSS score. When NVD has none we fall back to the CVE record and label the source.
- Advisory links come first from the KEV notes, then from CVE references tagged as vendor advisory or patch.
- A failed fetch stops the build, so yesterday's site stays up rather than showing partial data.
What "Unknown" means
If no source states a value we show "Unknown". For fixed versions we link the vendor advisory. We never guess.
Freshness
| Source | Last successful check (UTC) |
|---|---|
| CISA Known Exploited Vulnerabilities | 30 Oct 2026, 12:10 UTC |
| CVE List v5 (MITRE) | 30 Oct 2026, 12:11 UTC |
| National Vulnerability Database | 30 Oct 2026, 12:10 UTC |
| FIRST EPSS | 30 Oct 2026, 12:11 UTC |
KEV catalog version 2026.10.29, 1764 entries.
Sponsors
Sponsors are security tool vendors. We never accept sponsorship from a vendor whose products appear in our listings. Sponsored slots are always labelled and never change ordering or data.
Licences and notices
- This product uses the NVD API but is not endorsed or certified by the NVD.
- EPSS: See EPSS at https://www.first.org/epss
- KEV data: Cybersecurity and Infrastructure Security Agency, CC0.
- CVE®: Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. Use of the CVE List is subject to the CVE Terms of Use. Licence: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
Built and run by Auburn Intelligence.