CVE / KEV 查询
输入 CVE 编号，即可在一个页面查看严重程度（CVSS）、被利用概率（EPSS）、是否已有实际利用确认（CISA KEV）以及修复线索。优先读取本站自有的情报源数据库，没有时再从 NVD/FIRST 获取。
- 发送
- 将CVE编号发送到本站服务器
- 保存
- 不保存查询内容（编号可能留在URL和日志中）
- 外部API
- 服务器向NVD、OSV.dev、FIRST发送CVE编号
- 对象
- 仅查询公开的CVE编号
详细说明
- 执行查询时，CVE编号会发送到本站服务器。服务器查询本站数据库，并在需要时向NVD、OSV.dev、FIRST（EPSS）的公开API发送CVE编号。
- 查询内容不会记录到数据库。CVE编号包含在URL中，因此可能留在浏览器历史和访问日志中。
- 在结果页面的版本、配置比对栏中输入的值只在浏览器内处理。请勿输入CVE编号以外的信息（密码、个人信息、认证信息）。
- 页面本身的访问会记录在访问日志中（IP地址、时间、用户代理等）。工具页面不加载广告和访问分析。 隐私政策
NVD record state: Awaiting analysis
This describes NVD analysis work, not whether your product/version is affected. Pending, unscheduled or missing analysis does not establish safety or lack of impact.
NVD state stored by this site; the latest state was not rechecked for this lookup.
Reported state: Awaiting Analysis
NVD record modification: 2026-11-12T20:18:15.073ZThis is not the retrieval or rejection time. Consult the original for the full change history.
Stored description; verify against the original record
A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.
Stored representative assessment
Assessor: secalert@redhat.com / primary
Reported vector (score not recalculated): CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Compare CVSS assessors, versions and vectors (1)
CVSS Base describes severity, not the probability your system is compromised. For NVD records the display policy is the latest available version, then Primary within that version, then reported order. This does not maximize scores or identify Primary as NVD. Examine the platform and vectors; do not average different assessments.
Assessments below are from a stored NVD record, not a current recheck or complete history. At most the first 16 per version. An assessor is not inferred for legacy representative-only data.
CVSS 3.1 / 9.6
Assessor: secalert@redhat.com / primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA KEV records confirmed real-world exploitation, not continuous attack monitoring or compromise of your environment. EPSS forecasts observed exploitation over the next 30 days from its evaluation date, not the probability your site is compromised. Percentile is relative rank; the trend shows earlier daily forecasts. Low EPSS does not cancel confirmed KEV evidence. A CISA catalog due date is not treated as a universal legal deadline.
This product uses the NVD API but is not endorsed or certified by the NVD. Exploited-vulnerability data: CISA KEV (CC0). EPSS: see EPSS at https://www.first.org/epss. CWE™ is a trademark of The MITRE Corporation. Open source package data: OSV.dev / GitHub Advisory Database (CC BY 4.0).
使用方法
- 1
输入您关注的 CVE 编号（示例：CVE-2021-44228）。
- 2
页面会显示 CVSS、EPSS、KEV（是否有利用确认）以及修复线索。
- 3
通过“本站的解读文章”或“NVD 官方”页面进一步了解详情。
为什么重要
常见问题
Q什么是 KEV？
这是 CISA 收录已确认在实际环境中被利用的漏洞的目录。应优先考虑这些证据，但收录不代表攻击现在仍在持续，也不证明您的环境已受害。
QEPSS 和 CVSS 有何区别？
CVSS 基础分数表示严重程度。EPSS 是从评估日期起未来 30 天内在实际环境中观测到利用的估计概率，并非您的系统受害概率。还需确认产品、版本和暴露情况。
Q任何 CVE 都能查询吗？
本站优先读取数据库，缺失的信息再查询 NVD。本地没有记录或获取失败，均不能证明 KEV 未收录或没有影响。