Tool
Vulnerability intelligence lookup
Enter a CVE ID. We read the public records and show three different signals side by side: how severe it is, whether attackers are known to use it, and how likely exploitation is estimated to be. Public sources only. This tool never scans anything.
Look up a CVE
Enter a CVE ID to see its severity, whether it is known to be exploited, and the estimated chance of exploitation, side by side.
Data from the National Vulnerability Database (NIST), the CISA Known Exploited Vulnerabilities Catalog and EPSS from FIRST. This product uses data from the NVD API but is not endorsed or certified by the NVD. We keep a short-lived copy of the public records so repeat lookups do not hit those services again. Lookups are not tied to a name or an account.
Three signals, three different questions
No single number tells you what to fix first. Each of these answers a different question.
| Signal | What it answers | Who publishes it | What it does not tell you |
|---|---|---|---|
| CVSS | How bad would it be if someone exploited it? A score from 0 to 10 for severity. | The NVD and the vendor, using the FIRST CVSS standard | Whether anyone is exploiting it, or whether it affects your configuration. |
| CISA KEV | Has exploitation been observed in the wild? A yes or no list of confirmed cases. | CISA | Whether you are exposed. Not listed does not mean safe, only that CISA has not added it. |
| EPSS | How likely is exploitation activity in the next 30 days? A model-estimated probability. | FIRST | Your own risk. EPSS is not a company-specific score, and it does not know your systems. |
None of the three knows how important the affected system is to you, how exposed it is or what other controls protect it. Those decide the real priority.
How the signals combine in practice
Illustrative reasoning, not a rule. Real decisions also weigh exposure, business importance and compensating controls.
| Situation | What the signals suggest | Typical handling |
|---|---|---|
| Listed in KEV, on an internet-facing system | Exploitation is observed and the system is reachable. | Treat as an emergency change. Patch or apply the vendor mitigation first and check for signs of prior compromise. |
| High CVSS, not in KEV, low EPSS, internal system | Serious in theory, rarely used so far, not reachable from outside. | Schedule within the normal patch cycle, and raise the priority if exploitation starts. |
| Moderate CVSS, listed in KEV | Less dramatic on paper, but attackers use it. | Move it up the list. Observed exploitation outweighs a middling score. |
| High CVSS, high EPSS, not yet in KEV | Likely to be exploited soon, with no confirmed case yet. | Patch the exposed systems early. Watch the KEV catalog and vendor advisories. |
| No patch available | The signals cannot be acted on with an update. | Use compensating controls: restrict access, disable the feature, add detection and monitor the vendor. |
Questions people ask
Where does the data come from?
The National Vulnerability Database (NIST), the CISA Known Exploited Vulnerabilities Catalog and the EPSS service from FIRST. Each is public.
Why does a result say it came from a stored copy?
To be polite to those services and fast for you, we keep a short-lived copy of each record. The result says how old it is. If a source is down, we show an older copy and say so, or say nothing was retrieved.
Why is there no EPSS score for a CVE?
New or rarely discussed CVEs may not be scored yet. We do not estimate one.
Can I look up a product or a version?
Not here. The lookup works by CVE ID. A scan or an asset inventory tells you which CVEs apply to what you run.
Related
-
Enterprise vulnerability management
Design and run a vulnerability management program: ownership, prioritization rules, ticket routing, exceptions and measurement.
-
Vulnerability assessment
Broad, authenticated scanning of networks, servers, endpoints and applications, with validation so the report lists real findings.
-
Security assessment planner
Answer questions that fit the service you want and get a structured, preliminary scope we can discuss.
Tell us which of these is you
I need a technology project delivered
Describe the system, the change and the timeline. A technical lead replies to talk about scope.
Discuss a projectI need to hire technical talent
Send the role, headcount and start date. A recruiter confirms the details before sourcing starts.
Request talentMy systems may be at risk
Ask for an assessment, a penetration test or help fixing findings. Under attack now? Call.
Speak with a security expert