PatchTheCEV
Know what to patch first, and exactly how.
Every CVE is ranked by real-world risk (severity, exploitation, reach) and comes with the affected versions, the exact fix for your OS, and a clear action: upgrade, or downgrade if no fix exists yet.
Checked every 20 minutes/
Official sources NVD · CVE Program · CISA KEV · EPSS · vendor and distro advisoriesHow we score · Source status · Open data · About
Try it: check a CVE or product instant priority score and fix
Try:
Start here
How it works: click through collect → score → fix
Step 1 of 3
Prefer a video?
Severity mix
New CVEs, last 14 days
How PatchTheCEV works
1CollectNew and changed CVEs from NVD and the CVE Program, plus CISA's exploited list, every 20 minutes.
2ScoreEPSS, CISA SSVC, exploit code and reach turn each CVE into a 0 to 100 priority.
3Find the fixDistro, Microsoft, GitHub and OSV advisories give the fixed version, or a safe downgrade.
4PublishA page per CVE, product, vendor and patch, plus the blog, goes live automatically.
Browse recent CVE pages
CVE-2026-115975 – Broken access control in JiraController in Cervantes version v1.3-beta could allow an attacker to create, editCVE-2026-96185 – Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a CVE-2026-95709 – Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated CVE-2026-95708 – Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated CVE-2026-95707 – A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker witCVE-2026-95706 – Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacCVE-2026-95705 – Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacCVE-2026-95704 – A vulnerability in the web-based management interface of wireless network management systems could allow an auCVE-2026-91093 – A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which mightCVE-2026-79956 – A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attCVE-2026-79891 – A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticaCVE-2026-79890 – There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution CVE-2026-79889 – Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attCVE-2026-79888 – A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attCVE-2026-79887 – A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remoteCVE-2026-79858 – An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8CVE-2026-79857 – There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of CVE-2026-79856 – A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remotCVE-2026-79855 – An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker toCVE-2026-79854 – A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct CVE-2026-79852 – A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker toCVE-2026-75779 – Improper Neutralization of Special
Elements used in an OS Command (“OS Command Injection”) and Cross-Site RequCVE-2026-114625 – Arista VeloCloud Orchestrator SQL Injection VulnerabilityCVE-2026-111497 – A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 throughCVE-2026-110447 – Collabora Online – Built-in CODE Server OS Command Injection VulnerabilityCVE-2026-108456 – Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges oveCVE-2026-105014 – Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows CVE-2026-101813 – Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management)CVE-2026-101809 – Vulnerability in the Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer)oracle vulnerabilitiesgoogle vulnerabilitiesibm vulnerabilitiesapache vulnerabilitiesmicrosoft vulnerabilitiessiemens vulnerabilitiesmozilla vulnerabilitiesadobe vulnerabilitiesflowiseai vulnerabilitieslinux vulnerabilitieslangflow vulnerabilitiessamsung vulnerabilitiesmongodb vulnerabilitiesjfrog vulnerabilitiesmediatek vulnerabilitiesredhat vulnerabilitiesnvidia vulnerabilitiescisco vulnerabilitiesn8n vulnerabilitiessamba vulnerabilitiesprogress vulnerabilitiesgitpython project vulnerabilitiespaloaltonetworks vulnerabilitiescanonical vulnerabilitieseclipse vulnerabilitiesjetbrains vulnerabilitiesphp vulnerabilitiescheckmk vulnerabilitiesbalbooa vulnerabilitiesfortinet vulnerabilitiesfreerdp vulnerabilitiesqualcomm vulnerabilitiessap vulnerabilitiesamazon vulnerabilitiesdebian vulnerabilitiesdell vulnerabilitiesggml vulnerabilitiesjoomla vulnerabilitiesopenclaw vulnerabilitiesapple vulnerabilitiesCVEs by OracleCVEs by GitHub, Inc.CVEs by VulnCheckCVEs by PatchstackCVEs by ChromeCVEs by VulDBCVEs by kernel.orgCVEs by Apache Software FoundationCVEs by IBM CorporationCVEs by Microsoft CorporationCVEs by TuranSecCVEs by MITRECVEs by Siemens AGCVEs by Red Hat, Inc.CVEs by Cisco Systems, Inc.CVEs by Joomla! ProjectCVEs by Hewlett Packard Enterprise (HPE)CVEs by Drupal.orgCVEs by Mozilla CorporationCVEs by HackerOneCVEs by Zephyr ProjectCVEs by Adobe Systems IncorporatedCVEs by GitLab Inc.CVEs by MongoDB, Inc.CVEs by WPScanCVEs by EEFCVEs by ICS-CERTCVEs by MediaTek, Inc.CVEs by SAP SECVEs by CERT.PLCVEs by Rapid7, Inc.CVEs by Switzerland Government Common Vulnerability ProgramCVEs by Computer Emergency Response Team of the Republic of TurkeyCVEs by AMZNCVEs by CPANSecCVEs by JFrogCVEs by Eclipse FoundationCVEs by Samsung MobileCVEs by curlCVEs by NVIDIA Corporation