Patch Week: what to patch first
Every ISO week, the CVEs CISA added to the Known Exploited Vulnerabilities catalog, sorted by what to patch first: ransomware-linked entries, then the nearest federal due date. The pages are rebuilt from the wire data on every deploy, so the current week is always current.
$ patch-week --this-week
Newest week with data: 2026-W45, 2 to 8 November 2026.
┌─ this week 2026-W45
Patch Week 45, 2026: what to patch first
2 to 8 November 2026
2 CVEs were added to CISA KEV that week, 0 of them with known ransomware use. The most additions came from Apple (1) and WordPress (1). Our wire published 4 news stories that week.
$ ls -lat /var/log/patch-week
10 weeks in range (2026-W36 to 2026-W45), newest first. 10 are indexable; thin weeks stay out of the sitemap.
- 2026-W45 2 to 8 November 2026 2 KEV adds · 0 ransomware · 4 stories
- 2026-W44 26 October to 1 November 2026 10 KEV adds · 0 ransomware · 0 stories
- 2026-W43 19 to 25 October 2026 8 KEV adds · 0 ransomware · 0 stories
- 2026-W42 12 to 18 October 2026 9 KEV adds · 0 ransomware · 0 stories
- 2026-W41 5 to 11 October 2026 5 KEV adds · 0 ransomware · 0 stories
- 2026-W40 28 September to 4 October 2026 6 KEV adds · 0 ransomware · 0 stories
- 2026-W39 21 to 27 September 2026 12 KEV adds · 0 ransomware · 0 stories
- 2026-W38 14 to 20 September 2026 7 KEV adds · 0 ransomware · 0 stories
- 2026-W37 7 to 13 September 2026 14 KEV adds · 0 ransomware · 0 stories
- 2026-W36 31 August to 6 September 2026 10 KEV adds · 0 ransomware · 0 stories