Last week I released the Patch Tuesday Tracker, a free, open-source tool that automatically collects security patch data across nine major platforms. After deploying the Patch Tuesday Tracker, I realised it would be useful to track even more information..
So here are two more.
KEV Tracker – Known Exploited Vulnerabilities, Know What’s Being Exploited Right Now
Every day, thousands of new vulnerabilities are published. Most will never be used in a real attack. But some are being exploited right now and knowing which ones changes everything about how you prioritise patching.
That’s exactly what CISA’s Known Exploited Vulnerabilities (KEV) catalog tracks: vulnerabilities confirmed to be under active attack in the wild. Not theoretical risk, actual, observed exploitation.
The KEV Tracker checks that catalog every single day and gives you:
- A live dashboard of recently added exploited vulnerabilities
- Ransomware flags – CVEs linked to known ransomware campaigns get marked in red
- Remediation deadlines – CISA sets due dates for US federal agencies, and they’re a strong urgency signal for everyone else
- A monthly archive of every addition, building a permanent historical record
Here’s the mindset shift this enables: when a vulnerability lands in KEV, it stops being a “we should get to that” and becomes a “we do this now.” If you only prioritise one patching list, make it this one.
View the KEV Tracker dashboard
EOL Tracker – End Of Life, Nothing Should Quietly Age Out of Support
Here’s an uncomfortable truth about the software in most environments: some of it is no longer receiving security patches at all and nobody noticed when that happened.
When software passes its end-of-life date, the vendor stops fixing it. Every vulnerability discovered after that day stays open forever. Attackers know this, which is why end-of-life systems are some of the most reliably exploited targets on the internet.
The EOL Tracker watches end-of-life and end-of-support dates for 20 products – Windows, Windows Server, macOS, iOS, Android, Ubuntu, Debian, Red Hat, Cisco IOS XE, PAN-OS, VMware ESXi, Exchange Server, SQL Server, Office, Python, PHP, Node.js, PostgreSQL, MySQL and more, checked daily. It shows you:
- What’s reaching end of life within 90 days – your upgrade planning window
- What recently went end of life – and probably shouldn’t still be running
- Full lifecycle tables for hundreds of product versions
At the time of writing, the dashboard is already earning its keep: Debian 12 reaches end of life in a matter of days, and Windows 11 24H2 (Home/Pro) and Office 2021 both hit their support cliffs this October. If any of those are in your environment, you now have a deadline.
View the EOL Tracker dashboard
The Complete Picture
With these two joining the Patch Tuesday Tracker, the suite now answers the three questions every business should ask about its software every month:
- What’s been patched? → Patch Tuesday Tracker
- What’s being actively exploited? → KEV Tracker
- What’s about to stop being protected at all? → EOL Tracker
Patch what’s released. Prioritise what’s exploited. Replace what’s expired. That’s patch management in one sentence and now there’s a free dashboard for each part.
Free, Open Source, No Catch
Like the Patch Tuesday Tracker, both tools are:
- Completely free – no accounts, no sign-ups, no tracking
- Open source (MIT) – fork them, run your own copies, extend them
- Built on official sources – CISA’s government feed and the endoflife.date API
- Fully automated – they update themselves daily with zero maintenance
Everything lives on the new Free Tools & Resources page, alongside the monthly Security Patch Roundup series they now help power.
Closing Thoughts
The most effective security improvements are rarely glamorous. Patching promptly, prioritising what’s actually being exploited, and retiring unsupported software will do more for most organisations than any shiny product – and none of it should cost anything to keep track of.
Check them out, share them with your team, and as always – patch early, patch often.
Explore all the tools: tayvensec.com/tools