Why it matters
A vulnerability on the KEV list has been exploited in real attacks, so automated tools are likely already looking for it. That makes it the most urgent kind of update there is, whatever its theoretical score.
How Patch checks
We identify the software your site loads (from version globals, licence banners, file names and CDN URLs), match each version against open advisory data from OSV.dev and the GitHub Advisory Database, and flag any match whose CVE is in CISA's Known Exploited Vulnerabilities catalogue. We say how sure we are of each version.
How to fix it
- Update the component to the fixed in or later today.
- If it comes from npm, run npm install the npm name@latest (or the fixed version) and redeploy. If it's a CDN link, change the version in the URL.
- Check the advisory for any extra steps, such as rotating secrets the flaw could have exposed.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere. The KEV list is published by the US government but tracks attacks worldwide.