Patchday: CVE Deadlines

Patchday helps CSIRTs and security teams keep track of when each vulnerability needs to be handled.

It pulls in CISA's Known Exploited Vulnerabilities Catalog and the latest JVN advisories, and lays them out by deadline on a calendar and in lists. KEV entries use CISA's due date. JVN entries count days from publication by severity (Critical 7, High 14, Medium 30, Low 90 — all adjustable).

■ Desktop apps and Apple's OSes too
• Vulnerabilities for software that PCs and developers rely on (iOS, iPadOS, macOS, Xcode, Safari, Chrome, Firefox, Acrobat Reader, Java, Node.js, Flutter / Dart, Git, curl, OpenSSL and more) come in from the NVD
• Products that get dozens of CVEs a day are grouped into one entry per product per day. Choose which products to follow in Settings

■ On-device translation
• Translate English summaries and required actions into Japanese on the device. Marked as machine translation, with the original one tap away

■ Planned releases on the same calendar
• Node.js security release pre-announcements, Microsoft Patch Tuesday and Oracle Critical Patch Updates appear with their own mark, separate from deadlines

■ See only what matters
• Watch vendors or products, and only those show up
• Mute what doesn't apply — right from a vulnerability's detail
• Filter by severity, source, product type (OS / apps / hardware), and hide what's done

■ Keep your team's progress
• Record Not Started, Announced, Discussed, Done, or Not Applicable for each vulnerability
• Add dated notes about who you told and what was decided
• Everything is stored in your iCloud and stays in sync across iPhone, iPad, and Mac

■ Widgets and Shortcuts
• See this week's count and the next deadline on your Home Screen and Lock Screen
• Ask Siri "What's due this week in Patchday"
• Record progress, add notes, or watch and mute from Shortcuts

Patchday isn't for collecting status from every department. It's for your CSIRT to keep track of what it has announced and discussed.

Patchday has no developer server and needs no account. It only connects to CISA (cisa.gov), JVN (jvn.jp), Node.js (nodejs.org) and the NVD (nvd.nist.gov).

Sources: CISA Known Exploited Vulnerabilities Catalog / JVN (Japan Vulnerability Notes) and JVN iPedia (IPA, JPCERT/CC) / NIST National Vulnerability Database (NVD). This product uses data from the NVD API but is not endorsed or certified by the NVD. Patchday is an independent app and is not affiliated with CISA, IPA, JPCERT/CC, or NIST.