Skip to content
>_ITDITDWeb Security Platform

CVE / KEV Lookup

Enter a CVE id to see severity (CVSS), exploit probability (EPSS), whether it's actively exploited (CISA KEV) and remediation pointers in one place. This site's own feed DB first, with a live NVD/FIRST fallback.

This tool reads this site's feed DB (CISA KEV + EPSS + NVD) and only fetches from public APIs (NVD/FIRST) for CVEs not in the DB. Your data is never sent.
Try an example (Log4Shell / CVE-2021-44228)
CVE-2026-102490ITD DBActively exploited (KEV)ITD priority: Critical

All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.

NVD official
Severity (CVSS)
CVSS9.4v4.0
Exploit probability (EPSS)
0.6%
EPSS percentile
49%
KEV added
2026-10-02
Remediation due
2026-10-05
Published
2026-09-30
Weakness type (CWE)
CWE-269

This product uses the NVD API but is not endorsed or certified by the NVD. Exploited-vulnerability data: CISA KEV (CC0). EPSS: see EPSS at https://www.first.org/epss. CWE™ is a trademark of The MITRE Corporation.

How to use

  1. 1

    Enter the CVE id you care about (e.g. CVE-2021-44228).

  2. 2

    CVSS, EPSS, KEV (actively exploited?) and remediation pointers are shown.

  3. 3

    Dig deeper via “this site's analysis” or the “NVD official” page.

Why it matters

CVSS is severity, but whether it gets exploited is a different question. Pairing EPSS (probability of exploitation in 30 days) with CISA KEV (exploitation actually observed) lets you decide realistically whether to fix it now. This site puts all three (CVSS × EPSS × KEV) on one screen.

FAQ

QWhat is KEV?
A

CISA's catalog of vulnerabilities with confirmed real-world exploitation. KEV-listed = attacks are actually happening — top priority to fix.

QEPSS vs CVSS?
A

CVSS is severity; EPSS is the probability of exploitation in the next 30 days. A severe bug can have low exploit probability — seeing both gives realistic prioritization.

QCan I look up any CVE?
A

KEV-listed CVEs in this site's DB show instantly. Others resolve via a live NVD fetch if they exist (KEV will then read 'not listed').

Related