What does the open source patch tracker cover?

Every actively exploited open-source vulnerability in the CISA Known Exploited Vulnerabilities catalog, mapped to the affected package and the exact version that fixes it using OSV.dev data: npm, PyPI, Maven, Go, RubyGems, and other ecosystems.

What does the fixed version column mean?

It is the first release of the package that remediates the CVE, from OSV-schema advisories (GitHub Security Advisories, PyPA, RustSec, and others). Upgrade to that version or later to close the vulnerability.

How is this list ranked?

By FIRST.org EPSS exploit probability, so the packages most likely to be attacked in the next 30 days rise to the top. Every entry is already confirmed exploited via CISA KEV, and ransomware-linked CVEs are flagged.

How often does the tracker update?

Daily. Data refreshes from CISA KEV, OSV.dev, NVD, and FIRST.org EPSS, so newly cataloged exploited CVEs and new fixed versions appear within a day.

Is the open source patch tracker free?

Yes, free with no sign-in, like every Senserva tracker. Running Senserva adds which of these vulnerable packages your own estate actually runs, ranked, so you fix the right things first.

Can I use this data with my own AI?

Yes. A free copy-paste AI prompt near the table is generated from the live data each day and carries the exploited packages and their fixed versions into Claude, ChatGPT, or Copilot, so you can draft upgrade tickets in your own words.

All patch & vulnerability trackers

The exploited open-source packages hiding in your dependencies

A free, no registration required, searchable table of exploited open-source vulnerabilities and the package version that fixes each, refreshed three times a day (5 AM, 12:30 PM, and 7 PM US Central). Open-source vulnerabilities that have a known package fix, ranked by real-world risk: actively exploited (CISA KEV, VulnCheck KEV, and the EU's EUVD) pinned to the top, then by EPSS exploit probability. Each row maps the CVE to the exact upgrade: the ecosystem (Maven, npm, PyPI, NuGet, Go, RubyGems, Packagist, and more), the package, and the fixed version, from the GitHub Advisory Database and OSV.dev. It is open data: search, sort, and export the whole table to CSV or JSON.

Senserva is a Microsoft Intelligent Security Association member

Open-source advisories with a fix from the GitHub Advisory Database and OSV.dev, cross-referenced with CISA KEV, VulnCheck KEV, the ENISA EUVD, and FIRST.org EPSS. Last updated 2026-07-20 20:33 GMT.

Most-affected open-source projects

Open-source projects with the most vulnerabilities that have a package fix. The red portion of each bar is the ransomware-linked share.

Exploitation trend

Exploited open-source CVEs added to CISA KEV per month, ransomware-linked highlighted.

Time frame12 months

Senserva provides Three Free Unlimited Audits, including all tenants and full Claude MCP.Start my Audit

Export:RSS

Take this data to your AI

Generated from the live data above, refreshed three times a day (5 AM, 12:30 PM, and 7 PM US Central). Copy it into Claude, ChatGPT, or Copilot. Free, no sign-in.

Tracking Microsoft instead?

See the Microsoft Patch Tracker for every Patch Tuesday KB and the CVEs it fixes, EPSS-ranked.

Microsoft Patch Tracker

Data sources

Every row is built from authoritative, public security feeds, refreshed automatically.

Source	What it provides
CISA KEV catalog	The actively-exploited list: which CVEs are exploited in the wild, plus ransomware use and the date added.
OSV.dev	The open-source package and the fixed version for each CVE. OSV.dev aggregates GitHub Security Advisories, PyPA, RustSec, and other OSV-schema sources across Maven, npm, PyPI, NuGet, Go, RubyGems, Packagist, and more.
NVD (NIST)	CVSS base score and severity for each CVE.
CIRCL CVE Search	CVSS fallback when NVD has no score yet, so newly added CVEs still get a severity.
EPSS (FIRST.org)	Exploit Prediction Scoring System: probability a CVE is exploited within 30 days, used to rank the list.
VulnCheck KEV	A broader Known Exploited Vulnerabilities list than CISA KEV, surfaced as a "VulnCheck KEV" signal. Data courtesy of VulnCheck, used with attribution.
ENISA EUVD	The European Union Vulnerability Database (ENISA, under NIS2), surfaced as an "EU EUVD" signal for EU teams. Courtesy of ENISA, used with attribution.

Package and fixed-version data from OSV.dev and the google/osv.dev project, used under the Apache License 2.0. Underlying GitHub Security Advisory records are licensed CC BY 4.0. Exploitation data labeled VulnCheck KEV is provided by VulnCheck and used with attribution per VulnCheck's terms; EU cross-references are from the ENISA EUVD. Senserva is not affiliated with or endorsed by OSV.dev, Google, VulnCheck, or ENISA. Always confirm the fixed version against the linked advisory before deploying.

Open-source fixes, mapped to what you run

This tracker ranks exploited open-source CVEs and the package versions that fix them. Senserva matches the same OSV, CISA KEV, and EPSS intelligence to the components and apps it finds across your Microsoft 365, Intune, Defender, and Entra ID estate, so you upgrade the few that are actually exposed.

Matched to your tenant

Senserva connects these package fixes to the software it inventories, so a fixed version becomes a concrete upgrade for a system you actually run.

CVE and patch management

One connected model

Open-source exposure joins configuration, logs, and Conditional Access in one model, so exploited-and-exposed rises to the top.

The unified security model

AI remediation you approve

Bring your own AI for validated, reviewable upgrade guidance grounded in your estate.

AI remediation

Compliance evidence

Every exposed component maps to the frameworks an auditor asks about, from the same model.

Compliance evidence

See where your own tenant stands

This tracker follows patches across the open-source world. To see where your own Microsoft 365 stands, run a free, unlimited audit.

Three free audits, across every tenant you manage: 1 scan to find, 2 to review your fixes. It finds:

Every missing patch, ranked by real attacks (CISA KEV, EPSS), so you fix the right things first.

The machines your consoles cannot see: unenrolled devices, silent patch failures, and servers with no patch path.

All 650+ security checks and audit-ready evidence, in an open results database that stays yours.

Includes our advanced Claude MCP: everything you need to run full audits.

Start my free audit