CVE
Explorer.
Look up a vulnerability by its CVE ID and get the two things that decide what you do next: what it is and how severe, and whether it is on the US government's list of vulnerabilities known to be exploited in the wild.
Corrections welcome — see our editorial policy.
Try
Exploitation status is answered from a local copy of the CISA catalog, so it works even when the NVD is rate-limiting.
Check what's exposed on your own server.
Grade a site's headers →What a CVE ID actually is
A CVE ID is a name, and nothing more. CVE-2021-44228 means "the 44,228th vulnerability identifier issued in 2021" — it carries no severity, no exploitability, no indication of whether anyone has ever attacked it. The identifier exists so that a vendor advisory, a scanner finding, a patch note and a news article can all refer unambiguously to the same flaw. Before CVE IDs, they frequently could not.
Everything else — the description, the severity score, the affected products — is attached afterwards by whoever analyses it. That is why two tools can show different scores for the same CVE, and why the number alone tells you very little.
Severity is a property of the flaw, not of your risk
CVSS is the standard severity score, from 0.0 to 10.0. It measures the vulnerability in isolation: how easy it is to reach, what privileges it needs, what it costs you if it works. It deliberately does not account for whether you run the affected software, whether the vulnerable component is reachable from anywhere that matters, or whether anyone is exploiting it.
This is the most common misreading in vulnerability work. A 9.8 in a library you do not ship is not an emergency. A 6.5 in an internet-facing service that is being actively exploited very much is. CVSS is an input to prioritisation, not the answer.
You may also see several scores for one CVE. NVD publishes CVSS v3.1 and often a legacy v2 score for older entries, and increasingly v4.0. This tool reports the newest version present, because the older one can materially understate a flaw — Log4Shell is 10.0 under v3.1 and 9.3 under v2.
The question that actually changes your evening
The useful signal is not "how bad could this be" but "is anyone doing it". CISA maintains the Known Exploited Vulnerabilities catalog: a list of CVEs with reliable evidence of exploitation in the wild. Inclusion is not a prediction or a score. It means observed, confirmed attacks.
That list is short. Roughly a thousand and a half entries against hundreds of thousands of published CVEs — well under one percent. If a CVE is on it, the argument about whether to patch is essentially over. US federal civilian agencies are legally required to remediate KEV entries by a due date, which is why each entry carries one; for everyone else the date is a useful sense of how urgent CISA considered it.
A subset are additionally flagged as used in known ransomware campaigns. If you are triaging a queue and one entry carries that flag, that is where to start.
Reading a "not listed" result correctly
This is where a tool like this can mislead, so it is worth being blunt: absence from the KEV catalog is not evidence that a vulnerability is safe. It means CISA has not published confirmed evidence of exploitation. Exploitation may be happening and unreported; it may be confined to targets that have not disclosed; it may begin tomorrow.
The catalog is also a point-in-time snapshot. This page tells you which catalog version answered your question and when it was released, so a "not listed" result always arrives with a date attached rather than as a timeless claim. Treat it as "not on the list as of this date", never as "not exploited".
Where these answers come from
Two sources, both chosen partly for their licensing, which is a real constraint for a free tool.
The National Vulnerability Database, run by NIST, supplies the description, the CVSS scores, the weakness classifications and the reference count. NVD data is in the public domain as a work of the US government. NVD requires that anyone using its API state plainly that the product is not endorsed by them, and this page does so with every result.
The KEV catalog, published by CISA, supplies the exploitation status. It is released under Creative Commons Zero, which explicitly permits commercial use — important for an ad-supported site. The licence also forbids using CISA's logo or the DHS seal, and is clear that using the data implies no endorsement. We credit CISA in words, display no government marks, and claim no endorsement.
We deliberately do not show EPSS, the exploit-prediction scoring system, despite it being the obvious third source. It publishes no licence, the site that hosts it reserves all rights, and its copyright page states that permission to reproduce may be required. That is too ambiguous to redistribute commercially. We would rather show two things we are certain we may show than three where one is a question mark.
Why the exploitation answer survives an outage
The KEV catalog is held locally as a periodically refreshed copy, not fetched live. That is partly speed, but mostly reliability: NVD enforces a strict rate limit and answers with an error when it is exceeded. If NVD is unreachable or throttling, this page still tells you whether the CVE is on the exploitation list — the half of the answer that most often decides what you do — and says plainly that the description could not be retrieved. A partial answer with its gap labelled is more useful than an error.
What this tool does not do
It does not scan you. Nothing here inspects your systems or tells you whether you are affected. That requires knowing what you run and at what versions, which is an inventory problem, not a lookup problem.
It does not list what is exposed on a host. Mapping an IP to its open ports and the CVEs affecting the services found there needs a passive scanning dataset, and the free option is licensed for non-commercial use only — so we do not offer it rather than serve it under terms we cannot meet. Our IOC enrichment report covers the signals we can license.
It does not tell you whether to patch. It gives you severity, exploitation status and the official remediation deadline where one exists. Whether the flaw is reachable in your environment is a question only you can answer.
Common questions
Why does another site show a different severity? Vendors publish their own CVSS scores alongside NVD's, and they often disagree. This page prefers NVD's own assessment where both exist, and reports the newest CVSS version available.
A CVE was just announced and this says "not found". A newly issued ID can exist before NVD has analysed it. Until then there is no description or score to show. The entry may also be marked "Awaiting Analysis" or "Rejected", which this page reports as-is rather than guessing.
How current is the exploitation list? Every result names the catalog version and its release date. CISA publishes updates roughly weekly, and our copy is refreshed against it — the build refuses to ship a copy more than 45 days old, precisely because a stale list would quietly answer "not exploited" for everything added since.
Should I use the CVSS score or the KEV listing to prioritise? Both, in that order of increasing weight. Filter by what you actually run, then treat KEV entries as the top of the queue regardless of score, then use CVSS to order the rest. The ransomware flag is worth pulling to the front of the KEV set.
What if the CVE is not in either source? Well-formed IDs that neither source knows are usually very new, reserved but unpublished, or withdrawn. The page says which source returned nothing rather than collapsing that into a single unhelpful "no results".
If you are working through a host's overall posture rather than one vulnerability, the HTTP header grader and SSL inspector cover the controls that limit what an exploited flaw can reach.