Low Severity
Published: Nov 3, 2026
Which CVEs hit the versions you actually run, and what to patch first: inventory to CPE, NVD ranges, CISA KEV, EPSS and exposure. No scanning.
<p align="center">
<picture>
<source media="(prefers-color-scheme: dark)" srcset="docs/assets/logo-dark.svg">
<source media="(prefers-color-scheme: light)" srcset="docs/assets/logo-light.svg">
<img src="docs/assets/logo-light.svg" alt="patchorder" height="64">
</picture>
</p>
<p align="center">Turns a short YAML inventory into a ranked CVE patch briefing.</p>
<p align="center">
<img src="docs/assets/readme-hero.png" width="800" alt="Terminal output of patchorder demo --fail-on kev: a briefing for a fictional inventory with the top five patch actions, CVE ids and priorities, and a KEV gate that exits with code 4.">
</p>
# patchorder
[](https://github.com/Abbasi26/patchorder/actions/workflows/ci.yml)
Which public CVEs apply to the versions in a local inventory, and what to patch first.
You keep a short YAML file: product, vendor, version, how many hosts, who owns them, and whether they face the internet. patchorder maps each row to CPE candidates, you pin the right one, and it decides affected / not affected / not decided from the published version ranges. The briefing ranks the work. It does not scan a network and it does not install updates.
## The problem
A vulnerability feed can tell you that something named nginx is having a bad week. It cannot tell you that twelve internet-facing proxies on 1.25.2 are in the vulnerable range and the three you already moved to 1.27.2 are not. [Vulnerability-Lookup](https://vulnerability.circl.lu/) returns every CVE for a vendor and product, on purpose, and leaves the version filter to the client. [OpenCVE](https://www.opencve.io/) subscribes you to a product. [CVE_Prioritizer](https://github.com/TURROKS/CVE_Prioritizer) scores a CVE list you already have. None of them starts from "Windows Server 2022, build 10.0.20348.2400, eight internal hosts."
That last step is this tool. The fictional Harbor Workshop inventory, run offli