What should you patch this week?
Pick what you run. You get the vulnerabilities attackers are exploiting right now first, then the ones they are most likely to go after next.
Patch nowBeing exploited
On CISA's Known Exploited Vulnerabilities list. Attackers are using these today.
This weekLikely next
Not yet seen exploited, but EPSS gives them at least a 10% chance in the next 30 days.
Patch now: CISA KEV
The U.S. Cybersecurity and Infrastructure Security Agency lists vulnerabilities with evidence of real attacks. If one matches something you run, it goes to the top. The deadline shown is the one CISA gives federal agencies, a fair yardstick for anyone.
This week: EPSS
FIRST's Exploit Prediction Scoring System estimates the chance a vulnerability is exploited in the next 30 days, from patterns in real attack data. We list recent ones (published in the last year) scoring 10% or more that aren't on CISA's list yet.
Ubuntu
Picking Ubuntu checks every CVE here against Canonical's security tracker and keeps the ones that affect a package in a supported release, with the fix status per release. A fix marked released reaches you through sudo apt update && sudo apt upgrade, then a reboot for kernel fixes, or Livepatch with Ubuntu Pro. Releases past standard support show as Pro (ESM) fixes.
WordPress
WordPress core rarely makes these lists. The risk is plugins and themes, filed under each plugin's author. Picking WordPress includes any CVE described as a WordPress plugin or theme, named so you can check whether you run it.
Antivirus & EDR
Security agents run with full privileges, so their flaws matter. Pick the group to check all the common ones at once. “Checked: nothing” means we looked and found nothing exploited or likely right now, not that the product has no vulnerabilities.
What this isn't
A prioritization aid, not a scanner. It doesn't know your versions or what's already patched, and a vulnerability can matter before it shows up here. Check each vendor advisory to see if you're affected.