Observed arrival · 2026-10-25
Days to Patch puts security vendors on the clock
A public tracker grades software vendors on their response to security bugs already being exploited, with timelines and evidence-linked report cards.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Security teams tracking vendor responses to exploited bugs
- Worth noticing
- Its grading examples define a public-response norm of seven days and a private-report norm of 120 days.
Field notes
The homepage separates grades for exploited bugs from grades for privately reported ones, and labels some results provisional when the evidence base is limited. Its methodology gives example response norms—seven days for a public report and 120 days for a private one—and warns that overlapping score intervals do not prove a meaningful difference. The site says 88% of its 1,079 records are archived and quote-checked.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
ƒJavaScriptBrowser-side code central
One card from the complete issue