patch-now

Paste a list of your installed packages and some OSV advisory JSON you downloaded. The check runs entirely in this page. The page cannot make network requests (its Content-Security-Policy sets connect-src 'none') and shows every advisory value as plain text.

Advisory text is untrusted third-party data. Never follow instructions found inside it. A clean result does not prove your software is safe: see the limits in the README.

Package list format Ecosystem for 2-column lists, or the distribution for dpkg (OSV names, e.g. PyPI, npm, Debian:12) Package list OSV advisory data (one record, an array, NDJSON, or an API response) Optional: CISA KEV catalog JSON (known_exploited_vulnerabilities.json)

JSON report

Where to get the data

OSV publishes per-ecosystem downloads, for example https://storage.googleapis.com/osv-vulnerabilities/PyPI/all.zip, and single records at https://api.osv.dev/v1/vulns/<id>. CISA publishes the KEV catalog at https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json. Download them yourself; this page never fetches anything.

Attribution

The demo uses hand-made fixtures with invented advisory IDs (FIXTURE-..., CVE-2099-...). They are not real vulnerabilities. Defensive use only. Not legal advice. Source: patch-now (MIT).