WTF are patches and advisories?

Short version

An advisory tells you what is broken and which versions are hit. A patch is the fix.

1. Flaw found

Someone spots a security flaw in a product.
2. CVE assigned

A CVE Numbering Authority gives it an ID, so everyone means the same bug.
3. Advisory

The official notice: what is broken and which versions are hit.
4. Patch

The update that repairs the flaw. Attackers read advisories too.
5. Exploited, added to CISA KEV

Attackers hit real targets. With reliable evidence and a clear fix, it goes on the list.
6. You patch

Move to the fixed version, then check for signs of compromise.

Real bugs do not always march in this order. A zero-day is attacked before any fix exists, and plenty of bugs never reach step 5.

Advisory: The official notice about a flaw. A useful one gives a description, the severity, the affected versions and the patched versions, plus any workaround.
Who publishes them: GitHub advisories carry those fields, and vendors publish their own.
Patch: The update that repairs the flaw. CISA describes patches as software and operating system updates that address security vulnerabilities.
Release notes: The changelog for that update. A security fix can get one dull line in there, so read the advisory as well.
"Upgrade to version X": X is the fixed version, usually the earliest one. Any version in the affected range is a target until you move to X or later.
Trap: no fix version: A malicious package has none. GitHub says the only safe course is not to use the package at all.
Trap: the quiet patch: A patch closes the hole without telling you who came through it first.

Affected: ExampleApp 2.0 to 2.3.4. Upgrade to version 2.3.5.

Everything in that range is a target until you run 2.3.5 or later.

Example only. The product, versions and names are made up.

Check the version you actually run, including copies buried in your dependency tree. Lock files such as package-lock.json will show them.
Update as soon as you can and turn on automatic updates where that makes sense.
Get updates from the vendor directly. CISA warns that attackers use emails to push malicious files disguised as legitimate updates, so do not trust the link in the message.