About PatchTheCEV

I'm a cloud security engineer with 3 years of experience in AWS security and DevOps. I built PatchTheCEV to turn CVE noise into clear next steps: what to patch first, and whether to upgrade, downgrade or mitigate.

Maintained by Pranay.

How it works

New CVEs are checked every 20 minutes and distro fixes are added every 2 hours. The site collects newly published and updated CVEs from the National Vulnerability Database, adds CISA's list of exploited vulnerabilities and EPSS exploit-likelihood scores, and looks up fixed package versions in the Ubuntu, Debian and Red Hat security trackers.

How the action is chosen

Upgrade when a fixed release exists. Downgrade when no fix exists but older releases are unaffected (never suggested for core system packages). Mitigate when neither is possible.

Trust and transparency

• Sources are public and official: NVD, the CVE Program, CISA, EPSS, vendor and distribution advisories. Every CVE page links to the original records so you can verify it.
• Method is open: see how we score and the full list of data sources with their health.
• Data is open: download it and check our work.
• Limits: the priority score is a guide, commands are templates, and some pages are built from data an automated check could not fully confirm. Always confirm against the vendor advisory.
• Corrections: found a mistake? open an issue on GitHub. We fix errors and say so.

PatchTheCEV is an independent project and is not affiliated with NIST, CISA, MITRE or any vendor named on this site.