Why it matters
A known vulnerability comes with public write-ups explaining how to exploit it. Not every one is reachable on every site, but updating is usually cheaper than working out whether yours is.
How Patch checks
We read version numbers from libraries' global objects in the page and from the licence banners at the top of your bundles, then compare them with a short list of advisories that have a CVE and a fixed version.
How to fix it
- Update the vulnerable libraries to their patched versions.
- If a library comes from a CDN link in your HTML, change the version in the URL. If it comes from npm, run npm install <name>@latest and rebuild.
- Retest the parts of the site that use them.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere.