Search the CVE database free. Look up any CVE ID, filter by vendor, severity or year, see CVSS, KEV and EPSS scores. Instant, no signup.
This free CVE lookup tool searches the CVE database by identifier, keyword, vendor, product, severity, and disclosure date, and returns the full record for each match: the description, CVSS score and vector, affected products, weakness classification, references, and known remediation guidance. The underlying data comes from NIST’s National Vulnerability Database (NVD), enriched with CISA’s Known Exploited Vulnerabilities (KEV) catalog and EPSS exploit-probability scores from FIRST. Nothing to install, no account, no API key — type a CVE ID or a product name and search.
The reason a CVE database search exists at all is that vulnerability disclosure is decentralised. A flaw is reported to a CNA (CVE Numbering Authority), gets an identifier of the form CVE-YYYY-NNNNN, and then that identifier becomes the shared key that scanners, patch notes, advisories, and ticketing systems all agree on. When your scanner reports CVE-2024-3400 and you need to know within five minutes whether it is being exploited in the wild, a CVE lookup is the first thing you do.
CVE-2021-44228 to jump straight to the full record.A CVE record is a claim about a specific weakness in specific software versions. The fields that drive decisions are:
| Field | What it tells you |
|---|---|
| CVE ID | The stable identifier: CVE, the year the ID was assigned (not necessarily the disclosure year), and a sequence number of four or more digits. |
| CVSS base score | Severity from 0.0 to 10.0. It measures intrinsic technical severity, not your risk. |
| CVSS vector | The reasoning behind the score, e.g. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. |
| CWE | The weakness class — SQL injection, path traversal, use-after-free — which tells you what kind of bug it is and how to prevent the next one. |
| Affected configurations | Version ranges expressed as CPE strings. This is what determines whether you are actually vulnerable. |
| KEV status | Confirmed exploitation in the wild, with a federal remediation due date. |
| EPSS | A probability, updated daily, that exploitation will occur in the next 30 days. |
The CVSS severity bands are Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), and Critical (9.0–10.0). Worked example: a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H means the flaw is reachable over the network, is easy to exploit, needs no privileges and no user interaction, and fully compromises confidentiality, integrity, and availability — producing a base score of 9.8. Change privileges required to High (PR:H) and the score drops to 7.2, because now the attacker must already hold admin rights.
The most common mistake in vulnerability management is patching strictly by CVSS score. CVSS describes how bad a flaw would be if exploited; it says nothing about whether anyone is exploiting it, or whether the affected component is even exposed in your environment. Tens of thousands of CVEs are published every year and a large share of them land in the Critical band, so “patch all criticals first” produces a queue no team can clear.
A better triage order uses all three signals together:
Use the CVSS calculator to re-score a vulnerability against your own deployment assumptions, and the CWE lookup to understand the underlying weakness class once you have identified the pattern.
Beyond direct search, the tool offers structured browse paths for the times when you do not have a specific identifier in hand:
There is also an Education tab covering the CVE lifecycle, how CNAs assign identifiers, what “reserved” and “disputed” states mean, and how CVSS metrics combine into a score.
CVE stands for Common Vulnerabilities and Exposures. It is a catalog of publicly disclosed security flaws, each with a unique identifier of the form CVE-YYYY-NNNNN. The identifier is the shared reference that lets a scanner, a vendor advisory, a patch note, and your ticket all point at the same flaw.
Yes. There is no signup, no API key, and no query cap for interactive use.
Vulnerability records come from NIST’s National Vulnerability Database (NVD) via its public API, cached so lookups return quickly. Exploitation status comes from CISA’s Known Exploited Vulnerabilities catalog, and exploit-probability scores come from FIRST’s EPSS model.
Records are refreshed from NVD on a short cache cycle, so newly published CVEs appear quickly. Be aware that NVD sometimes publishes a CVE before analysts have finished enrichment — a very recent entry may show a description and references but no CVSS score yet. That is an upstream state, not a gap in this tool.
CVE is the identifier and the catalog of specific flaws. NVD is NIST’s enriched database built on top of CVE, adding CVSS scores, CWE mappings, and CPE version data. CWE classifies the type of weakness (for example CWE-89, SQL injection). CVSS is the scoring system that turns exploitability and impact characteristics into a 0–10 number.
Yes. Enter the vendor or product name as a keyword, or use the vendor browse view. Then filter by severity or date to narrow to the disclosures relevant to the versions you actually run.
It means CISA has confirmed the vulnerability is being exploited in the wild and has added it to the Known Exploited Vulnerabilities catalog, with a remediation deadline that is binding on US federal civilian agencies and widely used as a benchmark elsewhere. Treat a KEV entry as a patch-now item regardless of its CVSS score.
EPSS (Exploit Prediction Scoring System) is a data-driven model producing a daily probability, from 0 to 1, that a vulnerability will be exploited within the next 30 days. CVSS measures intrinsic severity. A flaw can be CVSS 9.8 with an EPSS score under 0.01, meaning severe in principle but with no observed exploitation activity. Use CVSS for “how bad” and EPSS for “how likely”.
Yes. The CVSS Calculator tab implements CVSS v3.1 base scoring: pick attack vector, attack complexity, privileges required, user interaction, scope, and the confidentiality, integrity, and availability impacts, and the score and vector string update as you go. Copy the vector into a ticket to make your reasoning auditable.
The year in a CVE ID is the year the identifier was reserved, not necessarily the year the vulnerability became public. A CNA may reserve a block of IDs in advance, so it is common to see a CVE-2024- identifier published in 2025.
CVE (Common Vulnerabilities and Exposures) is a standardized system for identifying and cataloging publicly disclosed cybersecurity vulnerabilities. Each vulnerability receives a unique identifier in the format CVE-YYYY-NNNNN (e.g., CVE-2024-3094), enabling security professionals, vendors, and researchers to reference the exact same vulnerability without ambiguity.
Maintained by the MITRE Corporation under sponsorship from the U.S. Department of Homeland Security, the CVE program has cataloged over 200,000 vulnerabilities since its inception in 1999. This tool allows you to search the CVE database to understand vulnerabilities affecting your systems, assess their severity, and prioritize remediation.
When a vulnerability is discovered, it follows a structured disclosure process:
| CVE Field | Description | Example |
|---|---|---|
| CVE ID | Unique identifier | CVE-2024-3094 |
| Description | Technical summary of the flaw | Backdoor in xz/liblzma compression library |
| CVSS Score | Severity rating (0.0-10.0) | 10.0 (Critical) |
| CWE | Weakness classification | CWE-506: Embedded Malicious Code |
| References | Links to advisories and patches | Vendor advisory, NVD entry |
| Affected Products | CPE identifiers for impacted software | cpe:2.3:a:tukaani:xz:5.6.0 |
CVE (Common Vulnerabilities and Exposures) is a standardized identifier for known security vulnerabilities. Format: CVE-YEAR-NUMBER (e.g., CVE-2021-44228 for Log4Shell). Purpose: (1) Universal reference - Same vulnerability ID used across all vendors and security tools. (2) Coordination - Researchers, vendors, and users can discuss same vulnerability unambiguously. (3) Tracking - Monitor vulnerabilities affecting your systems. (4) Automation - Security scanners reference CVE IDs in reports. Managed by: MITRE Corporation maintains CVE system, CVE Numbering Authorities (CNAs) assign IDs, National Vulnerability Database (NVD) provides additional analysis. Lifecycle: (1) Researcher discovers vulnerability, (2) CNA assigns CVE ID (pre-disclosure), (3) Vendor develops patch, (4) Public disclosure with CVE, (5) NVD adds CVSS score and details. Usage: Vulnerability scanners (Nessus, Qualys) report CVEs, Patch management systems prioritize by CVE severity, Compliance audits track CVE remediation, Security advisories reference CVEs. Over 200,000 CVEs assigned since 1999. Critical tool for vulnerability management programs.
CVSS (Common Vulnerability Scoring System) quantifies vulnerability severity from 0.0-10.0. CVSS v3.1 Components: (1) Base Score (never changes): Attack Vector (Network/Adjacent/Local/Physical), Attack Complexity (Low/High), Privileges Required (None/Low/High), User Interaction (None/Required), Scope (Unchanged/Changed), Impact on Confidentiality/Integrity/Availability (None/Low/High). (2) Temporal Score (changes over time): Exploit Code Maturity, Remediation Level, Report Confidence. (3) Environmental Score (organization-specific): Modified Base metrics, Confidentiality/Integrity/Availability Requirements. Severity Ratings: 0.0: None, 0.1-3.9: Low, 4.0-6.9: Medium, 7.0-8.9: High, 9.0-10.0: Critical. Example: CVE-2021-44228 (Log4Shell) - Base Score: 10.0 (Critical), Attack Vector: Network (worst case), Attack Complexity: Low (easy to exploit), Privileges Required: None, User Interaction: None, Scope: Changed (can attack other systems), Impact: High across all three (C/I/A). Limitations: Doesn't account for asset value, ignores actual exploit likelihood in your environment, doesn't consider compensating controls. Best practice: Use CVSS as starting point, adjust based on your risk assessment, prioritize based on exploitability and asset criticality.
Multiple methods to identify relevant CVEs: Method 1: Vulnerability Scanners - Nessus, Qualys, Rapid7, OpenVAS scan systems, match installed software versions to CVE database, provide prioritized remediation lists. Method 2: Software Composition Analysis (SCA) - Snyk, WhiteSource, Black Duck analyze application dependencies, identify vulnerabilities in libraries (npm, Maven, PyPI), integrate with CI/CD pipelines. Method 3: Manual CVE Search - Search NVD by product name (cpe:2.3:a:apache:log4j:2.14.1), use this CVE lookup tool, check vendor security advisories, subscribe to CVE feeds. Method 4: Package Managers - npm audit, pip-audit, cargo audit check language-specific packages. Method 5: OS Security Updates - Red Hat Security Advisories, Ubuntu Security Notices, Windows Update lists CVEs. Best practices: (1) Maintain software inventory (SBOM - Software Bill of Materials), (2) Subscribe to vendor security mailing lists, (3) Automate vulnerability scanning weekly, (4) Prioritize internet-facing systems, (5) Test patches in staging before production. For critical CVEs: CISA Known Exploited Vulnerabilities (KEV) catalog lists actively exploited CVEs requiring immediate patching. Monitor CVE-2021-44228 (Log4Shell), CVE-2023-22515 (Atlassian), CVE-2023-34362 (MOVEit) type incidents.
CVE and CWE serve different purposes in vulnerability management: CVE (Common Vulnerabilities and Exposures) - Identifies specific vulnerability instances, unique ID for each discovered vulnerability, example: CVE-2023-12345 in specific product version, focuses on "what" is vulnerable. CWE (Common Weakness Enumeration) - Categories of vulnerability types, reusable classification of security flaws, example: CWE-89 SQL Injection, focuses on "why" vulnerability exists. Relationship: CVEs map to CWEs (one CWE can have many CVEs), CVE-2021-44228 (Log4Shell) maps to CWE-20 (Improper Input Validation) and CWE-502 (Deserialization). CWE Top 25 (most dangerous weaknesses): CWE-79: Cross-Site Scripting (XSS), CWE-89: SQL Injection, CWE-20: Improper Input Validation, CWE-78: OS Command Injection, CWE-787: Out-of-bounds Write. Usage: Developers: Learn CWEs to avoid vulnerability classes, Security teams: Track CVE instances requiring patching, Researchers: Categorize findings with CWEs, Training: Teach CWE patterns. Analogy: CWE is the disease category (influenza), CVE is the specific outbreak (2023 flu strain affecting specific population). Both maintained by MITRE, complementary systems for vulnerability classification and management.
Patch timelines vary greatly by severity and vendor: Industry averages: Critical vulnerabilities: 7-30 days, High severity: 30-90 days, Medium/Low: 90-365 days or never. Factors affecting timeline: (1) Complexity - Simple fixes (config) vs code refactoring vs architecture changes. (2) Vendor resources - Large vendors (Microsoft, Google) faster than small projects. (3) Open-source - Can be hours (community) or years (abandoned projects). (4) Exploitation status - Active exploitation speeds up patching, proof-of-concept code increases urgency, theoretical vulnerabilities lower priority. Notable examples: Log4Shell (CVE-2021-44228): Initial patch 48 hours (but incomplete, multiple updates needed), Microsoft Exchange ProxyLogon: Patch released before public disclosure (0-day prevention), Heartbleed (CVE-2014-0160): Patch same day as disclosure but 2+ years for internet cleanup. Responsible disclosure: 90-day standard (Google Project Zero, CERT), vendors receive private notification, patch developed before public disclosure, extension possible for complex fixes. If no patch available: Apply compensating controls (WAF rules, network isolation), monitor for exploitation attempts, consider alternative software, pressure vendor for timeline. Patch validation: Test in staging environment, check for regression issues, monitor for incomplete fixes (patch Tuesday). Some CVEs never get patches (EOL software, theoretical issues, vendor disagreement on severity).
0-day (zero-day) vulnerabilities are unknown to vendors and lack patches: 0-day lifecycle: (1) Discovery - Researcher or attacker finds vulnerability, no public knowledge, no patch available. (2) CVE assignment - CNA can reserve CVE ID before disclosure (helps coordination), CVE marked "reserved" in public database. (3) Exploitation - Attackers may exploit before patch (zero days to prepare defense), highly valuable on black market ($100K-$1M+). (4) Disclosure - Vendor notified (responsible) or public disclosure (full disclosure), race to patch begins. (5) Patch released - Now a "1-day" or N-day vulnerability, attackers rush to exploit before patches deployed. CVE handling: Reserved CVE (pre-disclosure): Only ID public, details withheld, Published CVE (post-disclosure): Full details in NVD database. Famous 0-days: Stuxnet: Used 4 Windows 0-days simultaneously, NSA exploits: Leaked by Shadow Brokers (EternalBlue), iPhone jailbreaks: Often use 0-day chains. Defense strategies: (1) Defense-in-depth (assume breach), (2) Behavior-based detection (EDR tools), (3) Network segmentation, (4) Rapid patch deployment capability, (5) Virtual patching (WAF, IPS rules). Bug bounty programs: Microsoft, Google, Apple pay for 0-day disclosure, prevents black market sales, typical payout: $10K-$250K depending on severity. 0-days are highest priority when discovered in-the-wild.
Effective CVE prioritization prevents "patch fatigue" and focuses resources: Priority 1: Critical + Exploited - CVSS 9.0-10.0 with public exploit, active exploitation in-the-wild (check CISA KEV list), internet-facing systems, no compensating controls available. Patch within 24-48 hours. Priority 2: High + Easy to Exploit - CVSS 7.0-8.9 with low attack complexity, proof-of-concept code available, affects critical business systems, remote exploitation possible. Patch within 7-14 days. Priority 3: High + Internal Only - High severity but requires local access, systems not internet-facing, compensating controls in place, affects non-critical systems. Patch within 30 days. Priority 4: Medium + Widespread - Medium severity affecting many systems, potential for privilege escalation, chained with other vulnerabilities, affects important data. Patch within 60 days. Priority 5: Low/Medium + Limited Exposure - Low severity or highly constrained exploitability, requires multiple preconditions, affects isolated systems, theoretical vulnerabilities. Patch during normal maintenance cycles. Risk-based approach: Asset value × Threat likelihood × Vulnerability severity = Priority score. Tools for prioritization: CVSS Environmental Scoring (adjust for your environment), EPSS (Exploit Prediction Scoring System), Tenable VPR, Kenna Security Risk Score. Real-world factors: Compliance requirements, business disruption from patching, availability of patches, testing requirements. Best practice: Don't try to patch everything immediately, focus on internet-exposed critical assets, automate low-risk patching, test critical patches before deployment.
CNAs are organizations authorized to assign CVE IDs: Primary CNA - MITRE Corporation (original CVE authority), assigns CVEs when no other CNA applicable, coordinates the overall CVE program. Types of CNAs: (1) Vendor CNAs - Microsoft, Apple, Google, Oracle, Red Hat assign CVEs for their own products, understand impact and fix timelines, coordinate with security teams. (2) Researcher CNAs - GitHub Security Lab, Google Project Zero, Trend Micro Zero Day Initiative, discover vulnerabilities in various products. (3) Bug Bounty CNAs - HackerOne, Bugcrowd facilitate disclosure and CVE assignment. (4) National CNAs - CERT/CC (US), JPCERT (Japan), coordinate country-specific disclosures. (5) Open Source CNAs - Kubernetes Security Team, Python Security Response Team, Apache Security Team. CNA process: (1) Researcher reports vulnerability to CNA, (2) CNA validates it's a genuine security issue, (3) CNA assigns CVE ID (CVE-YYYY-NNNNN), (4) CNA coordinates disclosure with affected vendors, (5) CNA publishes details to NVD. Benefits of CNA system: Faster CVE assignment (vendors can self-assign), better coordination, more accurate initial information, reduced MITRE workload (200K+ CVEs managed). For researchers: Report to appropriate CNA, faster ID assignment, better vendor coordination. CVE ID Structure: CVE-2024-12345: 2024 = year requested (not disclosed), 12345 = sequential number within year, 4-digit minimum, up to 7 digits for busy years. As of 2024, there are 300+ CNAs worldwide, assigning ~25,000 new CVEs per year.