CVE / KEV Lookup
Enter a CVE id to see severity (CVSS), exploit probability (EPSS), whether it's actively exploited (CISA KEV) and remediation pointers in one place. ITD's own feed DB first, with a live NVD/FIRST fallback.
Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpoints, allowing for remote code execution.
- http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.htmlThird Party Advisory
- http://packetstormsecurity.com/files/165260/VMware-Security-Advisory-2021-0028.htmlThird Party Advisory
- http://packetstormsecurity.com/files/165261/Apache-Log4j2-2.14.1-Information-Disclosure.htmlExploit
- http://packetstormsecurity.com/files/165270/Apache-Log4j2-2.14.1-Remote-Code-Execution.htmlExploit
- http://packetstormsecurity.com/files/165281/Log4j2-Log4Shell-Regexes.htmlThird Party Advisory
- http://packetstormsecurity.com/files/165282/Log4j-Payload-Generator.htmlThird Party Advisory
- http://packetstormsecurity.com/files/165306/L4sh-Log4j-Remote-Code-Execution.htmlThird Party Advisory
- http://packetstormsecurity.com/files/165307/Log4j-Remote-Code-Execution-Word-Bypassing.htmlThird Party Advisory
- http://packetstormsecurity.com/files/165311/log4j-scan-Extensive-Scanner.htmlBroken Link
- http://packetstormsecurity.com/files/165371/VMware-Security-Advisory-2021-0028.4.htmlExploit
- http://packetstormsecurity.com/files/165532/Log4Shell-HTTP-Header-Injection.htmlExploit
- http://packetstormsecurity.com/files/165642/VMware-vCenter-Server-Unauthenticated-Log4Shell-JNDI-Injection-Remote-Code-Execution.htmlExploit
How to use
- 1Enter the CVE id you care about (e.g. CVE-2021-44228).
- 2CVSS, EPSS, KEV (actively exploited?) and remediation pointers are shown.
- 3Dig deeper via “ITD's analysis” or the “NVD official” page.
Why it matters
FAQ
QWhat is KEV?
CISA's catalog of vulnerabilities with confirmed real-world exploitation. KEV-listed = attacks are actually happening — top priority to fix.
QEPSS vs CVSS?
CVSS is severity; EPSS is the probability of exploitation in the next 30 days. A severe bug can have low exploit probability — seeing both gives realistic prioritization.
QCan I look up any CVE?
KEV-listed CVEs in ITD's DB show instantly. Others resolve via a live NVD fetch if they exist (KEV will then read 'not listed').