CVE / KEV Lookup
Enter a CVE id to see severity (CVSS), exploit probability (EPSS), confirmed exploitation (CISA KEV) and remediation pointers in one place. This site's own feed DB first, with a live NVD/FIRST fallback.
NVD record state: Analyzed
This describes NVD analysis work, not whether your product/version is affected. Pending, unscheduled or missing analysis does not establish safety or lack of impact.
NVD state stored by this site; the latest state was not rechecked for this lookup.
Reported state: Analyzed
NVD record modification: 2026-06-17T04:12:05.460ZThis is not the retrieval or rejection time. Consult the original for the full change history.
Stored description; verify against the original record
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
Stored representative assessment
Assessor: nvd@nist.gov / primary
Reported vector (score not recalculated): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Compare CVSS assessors, versions and vectors (3)
CVSS Base describes severity, not the probability your system is compromised. For NVD records the display policy is the latest available version, then Primary within that version, then reported order. This does not maximize scores or identify Primary as NVD. Examine the platform and vectors; do not average different assessments.
Assessments below are from a stored NVD record, not a current recheck or complete history. At most the first 16 per version. An assessor is not inferred for legacy representative-only data.
Missing, unsupported or invalid fields or row limits leave some assessments unverified. The displayed assessments may be incomplete.
CVSS 3.1 / 10.0
Assessor: nvd@nist.gov / primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS 3.1 / 10.0
Assessor: 134c704f-9b21-4f2e-91b3-4a467353bcc0 / secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS 2.0 / 9.3
Assessor: nvd@nist.gov / primary
AV:N/AC:M/Au:N/C:C/I:C/A:CVector format checking is unsupported for this version; reported text is retained.
CISA KEV records confirmed real-world exploitation, not continuous attack monitoring or compromise of your environment. EPSS forecasts observed exploitation over the next 30 days from its evaluation date, not the probability your site is compromised. Percentile is relative rank; the trend shows earlier daily forecasts. Low EPSS does not cancel confirmed KEV evidence. A CISA catalog due date is not treated as a universal legal deadline.
- http://www.openwall.com/lists/oss-security/2021/12/13/2Mailing List
- http://packetstormsecurity.com/files/165225/Apache-Log4j2-2.14.1-Remote-Code-Execution.htmlThird Party Advisory
- http://seclists.org/fulldisclosure/2022/Jul/11Mailing List
- https://cert-portal.siemens.com/productcert/pdf/ssa-397453.pdfThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VU57UJDCFIASIO35GC55JMKSRXJMCDFM/Release Notes
- http://www.openwall.com/lists/oss-security/2021/12/14/4Mailing List
- https://cert-portal.siemens.com/productcert/pdf/ssa-714170.pdfThird Party Advisory
- http://www.openwall.com/lists/oss-security/2021/12/10/2Mailing List
Check your package, version and release branch against each advisory, compatibility and other advisories before choosing a fix. Later versions are not automatically safe. OS distribution packages are not included.
- Affected
- ECOSYSTEM: >= 2.13.0, < 2.15.0ECOSYSTEM: >= 2.0-beta9, < 2.3.1ECOSYSTEM: >= 2.4, < 2.12.2+ 33 specific versions
- Fixed in
- 2.15.0, 2.3.1, 2.12.2
- Affected
- ECOSYSTEM: >= 1.8.0, < 1.9.2ECOSYSTEM: >= 1.10.0, < 1.10.8ECOSYSTEM: >= 1.11.0, < 1.11.10ECOSYSTEM: >= 2.0.0, < 2.0.11+ 39 specific versions
- Fixed in
- 1.9.2, 1.10.8, 1.11.10, 2.0.11
- Affected
- ECOSYSTEM: <= 1.2.1.2-jre17+ 362 specific versions
- Fixed in
- —
- Affected
- 1 specific versions
- Fixed in
- —
- Affected
- 1 specific versions
- Fixed in
- —
This product uses the NVD API but is not endorsed or certified by the NVD. Exploited-vulnerability data: CISA KEV (CC0). EPSS: see EPSS at https://www.first.org/epss. CWE™ is a trademark of The MITRE Corporation. Open source package data: OSV.dev / GitHub Advisory Database (CC BY 4.0).
How to use
- 1
Enter the CVE id you care about (e.g. CVE-2021-44228).
- 2
CVSS, EPSS, KEV (confirmed exploitation) and remediation pointers are shown.
- 3
Dig deeper via “this site's analysis” or the “NVD official” page.
Why it matters
FAQ
QWhat is KEV?
CISA’s catalog records vulnerabilities with confirmed real-world exploitation. Prioritize this evidence, but listing does not establish ongoing attacks now or compromise of your environment.
QEPSS vs CVSS?
CVSS Base describes severity. EPSS forecasts observed exploitation over the next 30 days from its evaluation date, not compromise of your system. Consider the product, version and exposure.
QCan I look up any CVE?
This site uses its DB first and NVD for missing information. A missing local row or failed retrieval does not prove absence from KEV or lack of impact.