CVE / KEV 查詢
輸入 CVE 編號，即可在一個頁面查看嚴重程度（CVSS）、被利用機率（EPSS）、是否已有實際利用確認（CISA KEV）以及修復線索。優先讀取本站自有的情報來源資料庫，沒有時再從 NVD/FIRST 取得。
- 傳送
- 將CVE編號傳送到本站伺服器
- 儲存
- 不儲存查詢內容（編號可能留在URL與紀錄中）
- 外部API
- 伺服器向NVD、OSV.dev、FIRST傳送CVE編號
- 對象
- 僅查詢公開的CVE編號
詳細說明
- 執行查詢時，CVE編號會傳送到本站伺服器。伺服器查詢本站資料庫，並在需要時向NVD、OSV.dev、FIRST（EPSS）的公開API傳送CVE編號。
- 查詢內容不會記錄到資料庫。CVE編號包含在URL中，因此可能留在瀏覽器紀錄與存取紀錄中。
- 在結果頁面的版本、設定比對欄中輸入的值只在瀏覽器內處理。請勿輸入CVE編號以外的資訊（密碼、個人資料、認證資訊）。
- 頁面本身的瀏覽會記錄在存取紀錄中（IP位址、時間、使用者代理等）。工具頁面不載入廣告與流量分析。 隱私權政策
NVD record state: Awaiting analysis
This describes NVD analysis work, not whether your product/version is affected. Pending, unscheduled or missing analysis does not establish safety or lack of impact.
NVD state stored by this site; the latest state was not rechecked for this lookup.
Reported state: Awaiting Analysis
NVD record modification: 2026-11-11T15:17:18.480ZThis is not the retrieval or rejection time. Consult the original for the full change history.
Stored description; verify against the original record
A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags.
Stored representative assessment
Assessor: secalert@redhat.com / primary
Reported vector (score not recalculated): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Compare CVSS assessors, versions and vectors (1)
CVSS Base describes severity, not the probability your system is compromised. For NVD records the display policy is the latest available version, then Primary within that version, then reported order. This does not maximize scores or identify Primary as NVD. Examine the platform and vectors; do not average different assessments.
Assessments below are from a stored NVD record, not a current recheck or complete history. At most the first 16 per version. An assessor is not inferred for legacy representative-only data.
CVSS 3.1 / 9.8
Assessor: secalert@redhat.com / primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA KEV records confirmed real-world exploitation, not continuous attack monitoring or compromise of your environment. EPSS forecasts observed exploitation over the next 30 days from its evaluation date, not the probability your site is compromised. Percentile is relative rank; the trend shows earlier daily forecasts. Low EPSS does not cancel confirmed KEV evidence. A CISA catalog due date is not treated as a universal legal deadline.
- CWE-1287Improper Validation of Specified Type of Input
This product uses the NVD API but is not endorsed or certified by the NVD. Exploited-vulnerability data: CISA KEV (CC0). EPSS: see EPSS at https://www.first.org/epss. CWE™ is a trademark of The MITRE Corporation. Open source package data: OSV.dev / GitHub Advisory Database (CC BY 4.0).
使用方法
- 1
輸入您關注的 CVE 編號（範例：CVE-2021-44228）。
- 2
頁面會顯示 CVSS、EPSS、KEV（是否有利用確認）以及修復線索。
- 3
透過「本站的解讀文章」或「NVD 官方」頁面進一步了解詳情。
為什麼重要
常見問題
Q什麼是 KEV？
這是 CISA 收錄已確認在實際環境中被利用之弱點的目錄。應優先考慮這些證據，但收錄不代表攻擊現在仍在持續，也不證明您的環境已受害。
QEPSS 和 CVSS 有何區別？
CVSS 基礎分數表示嚴重程度。EPSS 是從評估日期起未來 30 天內在實際環境中觀測到利用的估計機率，並非您的系統受害機率。仍須確認產品、版本及暴露情況。
Q任何 CVE 都能查詢嗎？
本站優先讀取資料庫，缺少的資訊再查詢 NVD。本機沒有記錄或取得失敗，均不能證明 KEV 未收錄或沒有影響。