Patch what attackers are actually using.
Every Tuesday, Gridwatch turns CISA's Known Exploited Vulnerabilities catalog and FIRST's EPSS exploit-likelihood scores into a short, ranked to-do list for small IT teams and MSPs. Plain English. Every item linked to its source.
Free every Tuesday. After you subscribe, check your inbox and click the link to confirm. One click to unsubscribe. See our privacy policy.
PHP Stale Internal Request-State Vulnerability. CISA due 2026-10-29.
PHP Memory Corruption Vulnerability. CISA due 2026-10-29.
Collabora Online – Built-in CODE Server OS Command Injection Vulnerability. CISA due 2026-10-26.
EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability. CISA due 2026-10-23.
Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability. CISA due 2026-10-23.
From Issue #1, built from CISA KEV v2026.10.26 and FIRST EPSS scores dated 2026-10-27. Read the full issue
Signal, not noise
A small team can't patch every CVE, so Gridwatch starts from the 1,758 vulnerabilities CISA has confirmed are exploited in the wild, then orders them by how likely they are to be hit next.
Exploited first
Every item is in CISA's KEV catalog: confirmed exploitation in the wild, not theoretical severity.
Ranked by likelihood
Each item carries its EPSS score, ransomware flag, and CISA due date, sorted into P1 / P2 / P3 tiers.
Fix link included
Every entry links to the vendor advisory or CISA alert and to NVD, so you go straight to the patch.
How we rank
| Tier | Rule | What to do |
|---|---|---|
| P1 | Known ransomware use, an EPSS exploit probability of 90%+, or a CISA due date within 3 days or already passed (overdue, counted for 30 days after the deadline) | Patch or mitigate now |
| P2 | EPSS exploit probability of 10% or more, or a CISA due date within 7 days | This patch window |
| P3 | Everything else in KEV (still exploited somewhere) | Normal cadence, do not skip |
Patch Priority Kit
The whole KEV catalog, ranked. A spreadsheet of all 1,758 entries with EPSS, tier, ransomware flag, due date and fix links, an inventory tab that flags what you run, and a 10-page PDF playbook for small teams. Refreshed monthly for buyers.
Patch Priority Kit One-time
- Full catalog spreadsheet (CSV + XLSX)
- Inventory matcher tab
- PDF triage playbook
Gridwatch Pro Monthly
- Same-day Flash alerts on new P1s
- Full ranked deadline queue weekly
- Monthly kit refresh + deadline calendar
FAQ
Who is it for?
Solo IT admins, small security teams, and MSPs who need a defensible patch order without a threat-intel budget.
Where does the data come from?
CISA's Known Exploited Vulnerabilities catalog and FIRST's Exploit Prediction Scoring System. Both are public; we cite the catalog version and score date in every issue.
Is it written by AI?
Issues are drafted by automation from the public data and checked before sending. Always confirm affected versions in the vendor's advisory.
What does it cost?
The weekly brief is free. The Patch Priority Kit is a one-time $19. Gridwatch Pro (same-day alerts, monthly kit refresh) is $10/month or $96/year. No ads, and we never sell your email.