CVE Explorer — free CVE lookup with CVSS, EPSS, CISA KEV and a clear patch priority
How it works — guide, priority levels & FAQ
How to look up a CVE and decide what to patch first
CVE lookup in 5 steps
- Search for a CVE ID (e.g. CVE-2021-44228), a vendor, a product or a keyword. Paste several IDs at once and you land in bulk triage.
- Read the priority: every CVE gets one of four levels — Act now, Soon, Plan or Watch — with the reasons listed, so you can explain the decision to your team.
- Open a CVE for the full picture: description, timeline, 30-day EPSS trend, every CVSS score with a plain-language breakdown, affected versions, fixes, weakness type and grouped references.
- Follow your stack: add the vendors and products you run to the watchlist and see what is new since your last visit.
- Share the result: export to CSV, copy a Markdown table for a ticket, or copy a link to a CVE or a triage list.
The four priority levels
| Level | When | What to do |
|---|---|---|
| Act now | On the CISA KEV list, CISA rates exploitation as active, or EPSS ≥ 40% with CVSS 7+ | Patch or mitigate within days |
| Soon | EPSS ≥ 10%, a public exploit with CVSS 7+, CVSS 9+ reachable without login, or automatable | Next patch cycle, about two weeks |
| Plan | CVSS 7+ or EPSS ≥ 1% | Regular patching |
| Watch | Everything else | Keep an eye on it |
The 0–100 number next to the level sorts CVEs within a level. It combines CVSS, EPSS, KEV and CISA's SSVC assessment. It is a triage aid, not a replacement for knowing your own exposure: a critical flaw in a product you don't run is not urgent for you.
CVSS severity ratings
| Rating | CVSS score | Usually means |
|---|---|---|
| Critical | 9.0 – 10.0 | Remote, unauthenticated, full compromise |
| High | 7.0 – 8.9 | Serious, may need some access or a user action |
| Medium | 4.0 – 6.9 | Limited impact or harder to exploit |
| Low | 0.1 – 3.9 | Minor impact, difficult conditions |
CVE vs. CWE vs. CVSS vs. EPSS vs. KEV vs. SSVC
- CVE — the ID of one vulnerability (CVE-YYYY-NNNNN), assigned by a CVE Numbering Authority (CNA), often the vendor.
- CWE — the type of weakness behind it, such as CWE-79 (cross-site scripting) or CWE-787 (out-of-bounds write).
- CVSS — a 0–10 severity score. Version 4.0 is newer; many CVEs still carry 3.1. NVD and the vendor can give different scores, and the explorer shows them all.
- EPSS — FIRST's daily estimate of the probability that a CVE is exploited in the next 30 days.
- CISA KEV — the Known Exploited Vulnerabilities catalog: evidence that attackers already use it.
- SSVC — CISA's decision data added to CVE records (Vulnrichment): is exploitation none, a proof of concept or active; is it automatable; is the technical impact partial or total.
Well-known CVEs
- Log4Shell · CVE-2021-44228
- XZ Utils backdoor · CVE-2024-3094
- regreSSHion · CVE-2024-6387
- PAN-OS GlobalProtect · CVE-2024-3400
- Citrix Bleed · CVE-2023-4966
- MOVEit Transfer · CVE-2023-34362
- ProxyLogon · CVE-2021-26855
- EternalBlue · CVE-2017-0144
- Heartbleed · CVE-2014-0160
- Shellshock · CVE-2014-6271
Popular vendor searches
CVE lookup and patch priority, explained
Where does the data come from?
Five public sources, queried directly from your browser: the NVD (NIST) for search and CVSS scores, CVE.org for the official record with the vendor's own score, affected versions and fixes, CISA KEV and CISA Vulnrichment for exploitation evidence, FIRST EPSS for exploit probability and the GitHub Advisory Database for open-source packages. Nothing passes through a server of mine.
Why does a recent CVE show no NVD score?
NVD enrichment lags behind publication, and since 2026 NIST focuses its own analysis on CVEs in the KEV catalog and software used by the US government. That's why the explorer also reads the CVE.org record: the vendor (CNA) or CISA often scored it already. Until any score appears, EPSS and KEV tell you how urgent it is.
What is a good or bad EPSS score?
Most CVEs score below 1%. A CVE with an EPSS score above 10% is far more likely than average to be attacked and deserves attention, even if its CVSS score is only medium. The detail page shows the 30-day EPSS trend, so you can see whether interest from attackers is rising.
Is the data real-time? How is it cached?
Searches go to the NVD API live. To stay fast and polite, results are cached in your browser: the CISA KEV catalog for 6 hours, the last 7 days of CVEs for 2 hours, EPSS scores for a day. If a source is down, the explorer shows the last cached copy and says so in the status bar. You can clear the cache in Settings.
Why are some NVD searches slow?
The free NVD API allows 5 requests per 30 seconds. The explorer queues requests and shows the wait in the status bar. With a free NVD API key (saved only in your browser) the limit is 50 per 30 seconds.
How does bulk triage work?
Paste anything that contains CVE IDs — a scanner export, a ticket, an email — or open a file. The IDs are picked out, deduplicated and looked up in CVE.org, KEV and EPSS in parallel, then sorted by priority. Export the table as CSV, copy it as Markdown, or copy just the "Act now" IDs.
Is the CVE Explorer free and private?
Yes: no signup, no ads and nothing to install. Your watchlist, recent CVEs and API key are stored in your browser's local storage and never sent anywhere, except that searches and lookups go straight to the public data sources above.