Disclaimer & terms of use

1. Information only, provided "as is"

Everything on the site, including the vulnerability information, fix details, severities, detection scripts and resolution scripts, is provided "as is" and "as available", without warranty of any kind, express or implied, including any warranty of accuracy, completeness, timeliness, merchantability, fitness for a particular purpose, non-infringement, or that the site will be uninterrupted, secure or error-free.

Nothing on the site is professional, security, legal or compliance advice, and using it doesn't create any support, consulting, service or other relationship with us.

2. The information may be incomplete or wrong

The data is collected automatically from third-party sources, including Microsoft, Apple and many software, network and hardware vendors (through NIST's National Vulnerability Database), Ubuntu, Debian, Red Hat, AlmaLinux, Rocky Linux, Oracle Linux, SUSE, openSUSE, Fedora, Arch Linux, FreeBSD, Amazon, Google (Android), OSV.dev and CISA, with exploit-likelihood scores from FIRST.org's EPSS and the list of published exploits from Exploit-DB (OffSec; Patch Sanity links to its entries and never copies or hosts exploit code). This product uses the NVD API but is not endorsed or certified by the NVD. Those sources can be late, incomplete or wrong, and so can the way the site reads, matches and summarises them: severities, affected products and versions, fixes, dates and descriptions may be missing, out of date or inaccurate.

Always confirm with the vendor's official advisory (linked on each CVE's page) before acting on anything you find here. A missing entry doesn't mean a system is safe, and a "fixed" status doesn't mean it is.

3. Detection scripts

The detection scripts are written to only read information, never change anything. Even so, they're provided without any warranty: read a script before running it, run it at your own risk, and try it on a non-critical machine first. A result is a hint, not a guarantee: distributions backport fixes, systems are configured differently, and a script can be wrong.

Sanity Check (Inventory) shows its script only after you accept these terms (once each time you sign in; it's recorded in your tenant's activity log). It works the same way: its one-time script only reads the operating system's version and build, the installed updates and the installed software, shows you a summary, and sends it only if you say so. Read it before running it (its address shows it as plain text). Its results compare what the machine reported with our CVE data: they can miss fixes a vendor backported, software the script couldn't see, or problems our sources don't list yet. An "Up to date" result doesn't mean a machine is safe. Always install updates through the maker's own tools (Windows Update, Software Update, your package manager), and confirm with the vendor's advisory. The same applies to a results file or SBOM you upload.

The script also asks the machine's own package manager which programs have newer versions (on Windows, Microsoft's winget, which contacts Microsoft's winget catalog; on macOS, Homebrew; on Linux, apt, dnf, apk or pacman, from the lists the machine already has). Those are third-party tools: their answers are theirs, and can be incomplete or out of date. If you tick Also install winget if it's missing, the Windows script installs Microsoft's App Installer from Microsoft when winget isn't there: that's a change to the computer, made at your request, at your own risk, under Microsoft's terms (see sections 4 and 5); it can fail on some editions of Windows. A program's "update page" link is whatever its own installer recorded; we show it but don't check it, so make sure it's the maker's real site before downloading anything.

SBOMs (Inventory) are checked against OSV.dev's open vulnerability data and ours, by each component's package address and version as the SBOM states them. An SBOM can be incomplete or wrong, OSV.dev's data is third-party, and the "Upgrade to" version is worked out by plain version order, which some packages don't follow. Components without a package address, or of a kind OSV.dev doesn't cover, aren't checked (the tab says which). Licence groupings are a rough guide from the licence names in the SBOM, not legal advice. "None known" doesn't mean a component is safe.

There's a huge variety of operating systems, versions, programs and package managers in the world. We do our best to cover what we can, but some will be missed, misread or matched wrongly, and no guarantee or warranty of any kind, express or implied, is given about what Sanity Check finds or doesn't find (see sections 1, 2 and 6).

5. Only on systems you're allowed to manage

Run the scripts (including their "remote machines" versions, and Sanity Check) only on systems you own or are authorised to administer. You're responsible for complying with your organisation's policies, your contracts and the law when you use anything from the site.

6. Limitation of liability

To the fullest extent the law allows, Mass Insanity Productions, LLC and its members, managers, employees and contributors are not liable for any loss or damage of any kind arising from or related to the site, its information or its scripts, or your use of or reliance on them, including direct, indirect, incidental, special, consequential or punitive damages, and including downtime, data loss, security incidents, lost profits or business interruption, even if we were told such damage was possible. The site is free; if any liability can't be excluded, it's limited to the amount you paid us to use the site, which is zero.

You remain responsible for the security of your own systems and for every change you make to them.

7. Indemnity

You agree to defend, indemnify and hold harmless Mass Insanity Productions, LLC and its members, managers and contributors against any claims, losses, damages, costs and expenses (including reasonable legal fees) arising from your use of the site or its scripts, or from your breach of these terms.

8. Third-party sites, names and trademarks

The site links to vendor advisories, NIST, CISA, the Microsoft Update Catalog and other third-party sites. We don't control them and aren't responsible for their content, availability or practices.

Product names, company names and logos belong to their owners and are used only to identify the products concerned. The site isn't affiliated with, sponsored by or endorsed by any vendor listed here.

The Server Sanity badge ("Server Sanity Monitoring by PatchSanity.com", with the Patch Sanity shield) and its files belong to Mass Insanity Productions, LLC. A tenant may show it only on a website that Server Sanity watches for that tenant, with the badge made for that website, unchanged, and only while it's watched; it must be removed when the website stops being watched. Using it anywhere else, copying it to another website, or changing it to suggest a site is monitored or endorsed when it isn't, isn't allowed, and we may ask for it to be removed or have it taken down. The badge says only that Server Sanity watches the website from outside, with the checks listed on its verify page (such as that it answers, and its certificate), using information that's already public. Server Sanity doesn't monitor or check a website's code, content, server or data, or what it does on its visitors' computers or with their accounts. The badge isn't a security scan, audit, certification or guarantee of the website, its owner, its content or its safety.

9. Privacy and cookies

Patch Sanity is by invitation, with personal accounts in tenants (customer organizations); using it also means accepting the beta non-disclosure agreement shown after each sign-in. How we handle the information of the people who use it is set out in the privacy policy. There's no advertising and no tracking or analytics scripts. Cookies are used only to keep you signed in and to remember a browser you chose to trust (for up to 8 hours, as your tenant allows); your display choices are saved with your account. Like any web server, ours keeps standard access logs (IP address, date and the page requested) for security and troubleshooting. Questions or requests: ask your tenant's Owner, or reply to any Patch Sanity email.

Donations are handled entirely by PayPal under PayPal's own terms and privacy policy; we never see or store your payment details.

10. Donations

Donations are voluntary gifts to Mass Insanity Productions, LLC to help keep the site running. They don't buy any product, service, support or priority, and they don't change these terms. Mass Insanity Productions, LLC isn't a charity, so donations aren't tax-deductible, and they're non-refundable except where the law requires otherwise.

11. Changes and availability

We may change, suspend or stop the site, its data or its scripts at any time without notice, and may update these terms. The date at the top shows the latest version; continuing to use the site after a change means you accept the updated terms. If any part of these terms can't be enforced, the rest still applies.

12. Governing law

These terms and any dispute arising from or related to the site are governed by the laws of the State of Arizona, USA, without regard to its conflict-of-law rules. Any such dispute will be brought only in the state or federal courts located in Arizona, and you consent to their jurisdiction.

13. Data sources and credits

The site is built from these public sources. Each source's data remains under its own terms, and none of them endorses, sponsors or is affiliated with this site.

• NIST NVD: CVE details and scores, and the Apple, app, network-device and hardware data. This product uses the NVD API but is not endorsed or certified by the NVD.
• CVE.org: the official CVE list (the CVE Program, run by MITRE for CISA), with each vendor's own record: our "Early detection" entries, shown before NIST NVD has reviewed them.
• CISA: the Known Exploited Vulnerabilities catalog: the "Exploited" flags and fix-by dates.
• EPSS by FIRST.org: the exploit-likelihood scores (Jacobs, Romanosky et al., FIRST EPSS Special Interest Group), updated daily.
• Exploit-DB by OffSec: the "Public exploit" flags: which CVEs have published exploit code, with a link to each entry.
• Microsoft: the Security Response Center (Windows and Microsoft apps) and the Microsoft Update Catalog.
• OSV.dev: Red Hat, Rocky Linux, SUSE, openSUSE and Android, every other OS and container image OSV lists (found automatically), plus extra detail for many CVEs; currently found automatically: Alpaquita, Alpine, Azure Linux, BellSoft Hardened Containers, Chainguard, CleanStart, Echo, Mageia, MinimOS, openEuler, Red Hat Lightwell, Root, TuxCare, Wolfi.
• Ubuntu: Ubuntu Security Notices (Canonical).
• Debian: the Debian Security Tracker.
• AlmaLinux: AlmaLinux Errata.
• Oracle Linux: Oracle Linux security advisories (ELSA).
• Fedora: Fedora updates (Bodhi).
• Arch Linux: the Arch Linux Security Tracker.
• FreeBSD: FreeBSD VuXML.
• Amazon: the Amazon Linux Security Center.
• Google Chrome: the newest Chrome release per platform (Version History API), to show whether a browser is up to date.
• Microsoft Edge: the newest Edge release per platform (Edge updates feed), to show whether a browser is up to date.
• Mozilla: the newest Firefox and Firefox ESR releases (product-details), to show whether a browser is up to date.
• Apple security releases: the newest Safari release, to show whether Safari is up to date.
• Brave: the newest Brave release and the Chrome engine version it's built on (GitHub releases), to show whether a browser is up to date.
• Opera: the newest Opera release (its release directory), to show whether a browser is up to date.
• Vivaldi: the newest Vivaldi release (its update feed), to show whether a browser is up to date.

How current the data is

We check each source on a schedule, so a change appears here some time after its publisher posts it, never instantly:

• Every hour: Early detection (vendor records, not yet reviewed by NVD), CISA exploited list
• Every 2 hours: Ubuntu, AlmaLinux, Amazon Linux, Fedora, Arch Linux
• Every 3 hours: Windows and Microsoft apps, macOS and iOS, Debian, Exploit likelihood (EPSS)
• Every 4 hours: Red Hat, Rocky Linux, SUSE and openSUSE, Android, Oracle Linux, FreeBSD
• Every 6 hours: Apps, Network & security devices
• Every 8 hours: Other OSes and container images (found automatically)
• Every 13 hours: Public exploits (Exploit-DB)
• Once a day: Hardware & firmware

On top of that wait, data that reaches us through a middleman waits there first: NIST NVD (NVD has to match each new CVE to products first: often days, sometimes weeks); Exploit-DB by OffSec (Exploit-DB reviews each submission first: usually days); OSV.dev (OSV collects it from each vendor first: usually within hours). So the newest issues, especially for apps and devices, may be missing or incomplete for a while. Always check the vendor's own advisory for anything urgent.

This list is kept up to date automatically; it last changed on October 30, 2026.

CVE® is a registered trademark of The MITRE Corporation. All product and company names are trademarks of their respective owners.

14. Logos

The OS and brand logos are trademarks of their owners and are shown only to identify each system. Windows and Microsoft icons: Font Awesome Free (CC BY 4.0). Other logos: Simple Icons (CC0), except the Debian logo (Software in the Public Interest, CC BY-SA 3.0), the Rocky Linux logo (Rocky Enterprise Software Foundation, CC BY-SA 4.0), the Apache logo (Apache License 2.0), the Git logo (Jason Long, CC BY 3.0), the PHP logo (CC BY-SA 4.0), the Jenkins logo (CC BY-SA 3.0), the Rust logo (CC BY-SA 4.0) and the Keycloak logo (under its project's own terms). The Fedora logo is a trademark of Red Hat, Inc., shown under the Fedora trademark guidelines; the Linux penguin (Tux) is by Larry Ewing, made with The GIMP.