Free Security Tool

CVE Lookup

Search the National Vulnerability Database by keyword or CVE ID. No signup.

Popular CVE searches

Get the full picture for your domain

Free recon check of your external footprint: headers, TLS, DNS, subdomains and CVE signals. Your report and a PDF summary, sent to your work email on that domain.

Free External Security Check

How to search for a CVE

This tool queries the National Vulnerability Database (NVD), NIST's authoritative source. Enter an identifier such as CVE-2021-44228 for one record, or a product or keyword such as log4j or openssl to list every match, each with its CVSS score, affected products and advisories.

How to find a CVE number for a vulnerability

A CVE number (CVE-YYYY-NNNNN) uniquely identifies a publicly disclosed vulnerability. Search by the affected software and version, then match the description to the flaw you are investigating. The NVD entry, vendor advisory and any proof of concept share that number, so you can track the fix across sources.

How to read a CVE record

  • CVSS score and severity: 0 to 10. Critical 9.0+, High 7.0 to 8.9, Medium 4.0 to 6.9, Low 0.1 to 3.9.
  • Attack vector and complexity: a network vector with low complexity is the most dangerous combination.
  • Affected products: vulnerable software and version ranges (CPE data), so you can confirm whether your stack is in scope.
  • References: vendor advisories, patches and analysis, tagged so you can jump straight to the fix.

Frequently asked questions

How do I search for a CVE?

Enter a CVE ID such as CVE-2021-44228 for a single record, or a product or keyword such as log4j to list every matching vulnerability. This tool searches the National Vulnerability Database directly.

How do I find a CVE number?

Search by the affected software name and version, then match the description to the vulnerability you are investigating. The CVE number appears at the top of each result in the form CVE-YYYY-NNNNN.

What is the NVD?

The National Vulnerability Database is the United States government repository of vulnerability data, maintained by NIST. It provides CVSS scores, affected product listings and fix references for every CVE, and it is free to search.

What is a CVSS score?

CVSS rates vulnerability severity from 0 to 10. Critical is 9.0 and above, High is 7.0 to 8.9, Medium is 4.0 to 6.9, and Low is 0.1 to 3.9. The score reflects attack vector, complexity and impact.

How do I check if my software is affected by a CVE?

Read the affected products section of the CVE record and compare the listed version ranges against your own software. For automated detection across your whole infrastructure, a CyberOrbit security assessment scans your stack for known CVEs.