CVE Lookup
Look up a vulnerability and see what it actually affects.
What this tool does
What it affects
The packages and version ranges, per ecosystem, rather than a prose description you have to interpret.
The CVSS vector, decoded
Severity is shown with its vector so you can see how the score was reached, not just the number.
Primary sources
Links to the advisory, the fix commit and the vendor notice, so you can read the original rather than a summary of it.
Honest coverage
OSV is comprehensive for open source. A CVE it does not carry is reported as absent rather than as non-existent.
Frequently asked questions
What is a CVE?
Common Vulnerabilities and Exposures — a public identifier for one specific vulnerability, in the form CVE-YEAR-NUMBER. It is a name, not a score: the identifier exists so that everyone discussing a flaw is discussing the same one, and severity is recorded separately.
Where does this data come from?
OSV, an open vulnerability database run by Google that aggregates advisories across open-source ecosystems — npm, PyPI, Go, Maven, crates.io, Linux distributions and more — and maps them to precise affected version ranges. It also carries GHSA identifiers from the GitHub Advisory Database.
Why is a CVE I searched for not here?
OSV covers open-source software comprehensively but is not a complete mirror of every CVE. A vulnerability in closed-source or vendor-specific software may have a valid CVE identifier and no OSV entry. The NVD is the fuller catalogue for those.
What does the CVSS vector mean?
It encodes how the vulnerability is reached and what it damages, and it is what produces the numeric score. The CVSS calculator on this site decodes a vector into its parts and shows how each contributes.
Does a high CVSS score mean I need to act now?
Not on its own. The base score describes the flaw in isolation and knows nothing about your environment. A 9.8 in a package you do not deploy, or that is unreachable from any input you accept, is less urgent than a 7.5 on your public login. Reachability and exposure decide priority.
What is a GHSA identifier?
A GitHub Security Advisory identifier. Many open-source vulnerabilities are published as a GHSA first, and a CVE may be assigned later or never. Both are searchable here, and OSV lists the aliases so you can move between them.
How do I know if I am affected?
Compare the affected version ranges against what you actually run. That is what a dependency scanner automates — the dependency checker on this site reads a lockfile and reports which of your installed versions fall inside a vulnerable range.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.