Vulnerability lookup
Search the known CVEs for any software version. Enter a product name and version and we match it against OSV, NVD and Red Hat (version-aware where the data allows), then return a prioritised CVE report, enriched with CISA KEV and EPSS so you fix what attackers exploit first.
Cross-referencing the vulnerability databases…
Not sure what to type? Start from the product
The software directory has a page for 1000 widely used products, from operating systems and firewalls to the npm and Python packages inside your applications, each with the versions already checked and the advisories they turned up.
How the vulnerability lookup works
A CVE (Common Vulnerabilities and Exposures) record describes one security flaw and the versions it affects. Searching CVEs by keyword returns every flaw a product has ever had; what you need to know is which of them affect the version you run. The lookup answers that: it reads the affected version ranges in the public advisory databases and keeps only the advisories that apply to your version, each with the version that fixes it.
What to fix first
Not every CVE matters equally. Each result is ranked by three things:
- Known exploited (CISA KEV). The flaw is being used in real attacks. Fix these first.
- Exploit probability (EPSS). How likely the flaw is to be exploited in the next 30 days, from 0 to 100%.
- Severity (CVSS). How bad the damage could be if it is exploited.
Finding the exact version
The version number decides the answer, so use the full one: from the program's About or
Help screen, from --version on the command line, or from your package manager
(dpkg -l, rpm -q, npm ls, pip show).
For a website, the WordPress
vulnerability check explains where to find the version of WordPress itself.
Common questions
Can I search for a CVE ID?
Each advisory in a report links to its public advisory record, and the ones we have published get a page of their own here. To find which CVEs affect your software, search by product and version as above.
Does a clean result mean my software is safe?
It means no published advisory matches that version. Flaws that are not yet public, or settings that weaken the software, are outside what any lookup can see, so keep updating even when the result is clean.
Is my lookup kept private?
No. A product and version that turns up advisories becomes a public page, so the next person checking it gets the answer instantly. Only the product name and version are published, never who checked it.
Scanning a whole estate?
Our Vulnerability Reporter service inventories your software and reports continuously.