Cybersecurity tool · Live NVD + CISA KEV · Edge-cached
Cybersecurity CVE Lookup
Paste a CVE ID (or batch up to 10) and get CVSS scoring, CISA KEV exploitation status, CWE classification, affected products, vendor advisories, and the cybersecurity role guides that should know about it. Lookups run server-side against the National Vulnerability Database and the CISA KEV catalog.
Free. No account required. Results cached at the Vercel edge for 1 hour per CVE.
Practice this exam
Practice the CompTIA CySA+ exam
CySA+ covers threat intelligence, detection and vulnerability management, the work this page describes.
- 40 practice questions in the bank.
- Practice and timed mocks are free, with right or wrong on every answer and your total score.
- Full analysis: $39, one payment for this exam, no subscription. 30-day full refund, no questions asked.
Start free CySA+ practiceNot sure which exam? Take Match
CompTIA CySA+ is a trademark of CompTIA. DecipherU is not affiliated with or endorsed by CompTIA.
One CySA+ practice question Incident Response and Management
During post-incident forensic analysis at a game studio, an analyst has a 32 GB memory image from a build server that was mining cryptocurrency. The disk image shows no unusual binaries because the miner ran from memory only. The analyst needs the list of processes that were running, their parent relationships, and any injected code regions. Which tool and approach fit?
Pick an answer. We tell you right or wrong.
Planning a CySA+ exam date? See which version you are taking, with the owner dates and the day we read each one.
How cybersecurity practitioners use this
- Triage during an incident. Paste the CVE you just saw in a SIEM alert. KEV status answers "is this being actively exploited" in one second.
- Patch prioritization. Batch-look up the open CVEs from your scanner. KEV-flagged + CRITICAL severity are the ones that fight for the maintenance window.
- Pen test planning. CWE classification + affected products tells you whether the bug is exploitable in the target's stack.
- Career-development link. Each result shows which DecipherU role guide owns this class of work, so juniors can study the path that leads to handling these vulnerabilities full-time.
Common questions
Where does the data come from?
Live from the National Vulnerability Database (NVD, https://nvd.nist.gov) for the CVE record, and from the CISA Known Exploited Vulnerabilities (KEV) catalog for the active-exploitation flag. Both are public, free, no authentication required. Lookups happen server-side and are cached at the Vercel edge for 1 hour per CVE (24 hours for the KEV catalog).
What does "in CISA KEV" mean?
The CISA Known Exploited Vulnerabilities catalog lists CVEs that have been observed in active attacks against U.S. infrastructure. CISA maintains the catalog. For federal civilian agencies, KEV-listed CVEs carry a binding patch deadline (typically two weeks). For everyone else, KEV inclusion is the strongest single signal that a vulnerability is being actively exploited and should be prioritized for remediation.
Why is severity sometimes UNKNOWN?
NVD assigns CVSS scores as part of the vulnerability analysis process. Newly published CVEs sometimes appear without a CVSS score for the first 24 to 72 hours while NIST analysts work the queue. Once analysis completes, CVSS v3.1 (and increasingly v4.0) scores show up here on the next 1-hour cache refresh.
Can I look up multiple CVEs at once?
Yes, switch to Batch mode and paste up to 10 CVE IDs comma-separated. Each lookup hits NVD individually and the results are returned together. The 10-CVE cap is a polite-citizen limit on the NVD rate budget; for bulk programmatic access, request an NVD API key and use the API directly.
Are the role-guide cross-links accurate?
They're heuristic, derived from the CWE classification on each CVE. We map common CWE families (injection, auth, crypto, supply chain) to the DecipherU career guides most likely to triage that class of vulnerability. SOC Analyst is included on every result because SOC analysts triage every CVE during incident workflows.