Patching guides

Practical, copy-paste guides for the questions that come up on every CVE.

• How to check an installed version and patch a vulnerable package (Linux, Windows, pip, npm)
  Copy-paste commands to find the installed version of a package and apply a security update on Ubuntu, Debian, RHEL, Amazon Linux, Alpine, Windows, pip and npm.
• CVSS, EPSS and KEV explained: how to decide which vulnerability to patch first
  What CVSS, EPSS and the CISA KEV list measure, why CVSS alone is a poor way to prioritise patching, and a simple order to work through your list.
• Upgrade or downgrade? What to do when a CVE has no fix yet
  A decision guide for vulnerable software with no patch: when upgrading is right, when a downgrade is safe, and which mitigations to use instead.
• Why your Linux package version does not match the advisory (backports explained)
  Why Ubuntu, Debian and RHEL packages can be patched even when the version number looks old, and how to verify a CVE is fixed.
• How to find the Windows KB update for a CVE and check it is installed
  Map a Microsoft CVE to its KB article, find which build fixes it, and verify the update with PowerShell.