One of the Github projects I started this year was a Known Exploited Vulnerabilities and End‑of‑Life tracking tools, a small engine that pulled CISA KEV entries and vendor EOL timelines, and highlighted assets that were both vulnerable and unsupported.
KEV tells you what’s being exploited.
EOL tells you what can’t be patched.
Putting them together gives you a real‑world risk picture that most organisations never see.
The KEV Tracker and EOL Tracker are two companion tools built alongside the Patch Tuesday Tracker as part of the TayvenSec open-source patch management suite. The KEV Tracker runs daily and monitors the CISA Known Exploited Vulnerabilities catalog, the authoritative list of CVEs confirmed to be actively exploited in the wild, automatically detecting new additions, flagging ransomware-linked CVEs, and surfacing remediation deadlines due within 14 days.
The EOL Tracker runs alongside it, monitoring end-of-life and end-of-support dates across 20 operating systems, network platforms, and server software products, classifying each version as supported, expiring soon, or end of life, and issuing automated notifications when anything in the tracked stack quietly ages out of support. Both tools update daily via GitHub Actions, publish live dashboards via GitHub Pages, and are designed around a simple principle, no changes, no noise. Together the three tools give practitioners a practical, automated view of patch priority, known exploitation, and software lifecycle risk without the manual overhead.
Like the Patch Tuesday Tracker these remain works in progress. I’m continuing to refine the collection and normalisation logic, improve source coverage, and validate the accuracy of the data. The long-term objective is a fully automated patch intelligence pipeline capable of generating complete monthly patch management reports from the collected data.