About
Days to Patch tracks security bugs that attackers are already using, and how fast each vendor responds.
Where the data comes from
- Vendor security advisories, feeds and revision histories.
- CISA's list of known exploited vulnerabilities.
- ZDI disclosure timelines for privately reported bugs.
- Public reports from researchers and the security press.
A researcher checks each incident timeline against its sources. Only reviewed timelines count toward a grade. The full list of sources and their health is on the sources page.
The two grades
- Response to exploited bugs. How fast a vendor speaks up and ships fixes once a bug is public.
- Fixing privately reported bugs. How long fixes take after a researcher reports a bug privately.
- Provisional means there is real evidence, but not enough yet for a firm letter.
- Not rated means there is too little evidence to grade.
Corrections
Found a wrong date or a broken source? Email disputes@daystopatch.com with the page link and your source. We check every report and note each correction on the page it affects.
Independence
Days to Patch is an independent project. Vendors can't pay to change a grade.
Not security advice
Always check the vendor's own advisory before acting.
Open data
All data is published as JSON and an RSS feed. Our crawler is DaysToPatchBot.