Cybersecurity CVE Lookup

Live from the National Vulnerability Database (NVD, https://nvd.nist.gov) for the CVE record, and from the CISA Known Exploited Vulnerabilities (KEV) catalog for the active-exploitation flag. Both are public, free, no authentication required. Lookups happen server-side and are cached at the Vercel edge for 1 hour per CVE (24 hours for the KEV catalog).

The CISA Known Exploited Vulnerabilities catalog lists CVEs that have been observed in active attacks against U.S. infrastructure. CISA maintains the catalog. For federal civilian agencies, KEV-listed CVEs carry a binding patch deadline (typically two weeks). For everyone else, KEV inclusion is the strongest single signal that a vulnerability is being actively exploited and should be prioritized for remediation.

NVD assigns CVSS scores as part of the vulnerability analysis process. Newly published CVEs sometimes appear without a CVSS score for the first 24 to 72 hours while NIST analysts work the queue. Once analysis completes, CVSS v3.1 (and increasingly v4.0) scores show up here on the next 1-hour cache refresh.

Yes, switch to Batch mode and paste up to 10 CVE IDs comma-separated. Each lookup hits NVD individually and the results are returned together. The 10-CVE cap is a polite-citizen limit on the NVD rate budget; for bulk programmatic access, request an NVD API key and use the API directly.

They're heuristic, derived from the CWE classification on each CVE. We map common CWE families (injection, auth, crypto, supply chain) to the DecipherU career guides most likely to triage that class of vulnerability. SOC Analyst is included on every result because SOC analysts triage every CVE during incident workflows.