Free Security Tool

CVE Lookup

Search the National Vulnerability Database by keyword or CVE ID. View CVSS scores, affected products, and remediation references. No signup required.

Popular CVE searches

How to search for a CVE

This CVE lookup tool queries the National Vulnerability Database (NVD), the authoritative source maintained by NIST, so you can search it two ways. Enter a specific identifier such as CVE-2021-44228 to pull a single record, or type a product or keyword such as log4j, openssl, or wordpress to list every matching vulnerability. Each result carries its CVSS score, severity, affected products, and links to the official advisories.

How to find a CVE number for a vulnerability

A CVE number is the unique identifier assigned to a publicly disclosed vulnerability, written in the form CVE-YYYY-NNNNN. To find the CVE number for a known issue, search this tool by the affected software name and version, then match the description to the flaw you are investigating. The NVD entry, vendor advisory, and any published proof of concept usually reference the same CVE number, so once you have it you can track the fix across every source.

How to read a CVE record

  • CVSS score and severity: a 0 to 10 rating. Critical is 9.0 and above, High is 7.0 to 8.9, Medium is 4.0 to 6.9, and Low is 0.1 to 3.9. Higher scores mean more urgent patching.
  • Attack vector and complexity: whether the flaw is reachable over the network and how hard it is to exploit. A network vector with low complexity is the most dangerous combination.
  • Affected products: the specific software and version ranges that are vulnerable, listed using standard CPE data so you can confirm whether your stack is in scope.
  • References: links to vendor advisories, patches, and analysis, tagged so you can jump straight to the fix.

Knowing a CVE exists is only half the job. Finding which of your own systems actually run the affected version is the harder part. A CyberOrbit assessment checks your stack for known CVEs alongside misconfigurations and 20+ other vulnerability classes, and maps the findings to the SOC 2 and ISO 27001 controls they touch.

Frequently asked questions

How do I search for a CVE?

Enter a CVE ID such as CVE-2021-44228 for a single record, or a product or keyword such as log4j to list every matching vulnerability. This tool searches the National Vulnerability Database directly.

How do I find a CVE number?

Search by the affected software name and version, then match the description to the vulnerability you are investigating. The CVE number appears at the top of each result in the form CVE-YYYY-NNNNN.

What is the NVD?

The National Vulnerability Database is the United States government repository of vulnerability data, maintained by NIST. It provides CVSS scores, affected product listings, and fix references for every CVE, and it is free to search.

What is a CVSS score?

CVSS rates vulnerability severity from 0 to 10. Critical is 9.0 and above, High is 7.0 to 8.9, Medium is 4.0 to 6.9, and Low is 0.1 to 3.9. The score reflects factors such as attack vector, complexity, and impact.

How do I check if my software is affected by a CVE?

Read the affected products section of the CVE record and compare the listed version ranges against your own software. For automated detection across your whole infrastructure, a security assessment scans your stack for known CVEs.