PermitANY
Tool · Security

CVE Lookup

Search the NIST National Vulnerability Database for any CVE ID. Returns the English description, the CVSS base score and its vector string, the CWE weakness classification, and the first references the NVD holds.

Examples

What this result does not prove

The score is a CVSS base score, one of three metric groups. It rates the flaw in the abstract — the same number for every organisation on earth — and three things follow.

  • It does not tell you whether you are exposed. Base assumes the component is reachable by whoever the attack vector says can reach it. A network-vector 9.8 on a service listening only on a management VLAN behind an ACL is not a 9.8 for you. The environmental metrics exist for that, and the NVD cannot publish them.
  • It does not tell you whether anyone is exploiting it. That is the temporal group, also absent here. A 7.5 with a working exploit in a commodity toolkit is a worse Tuesday than a 9.8 nobody has weaponised. Neither exploit status nor CISA KEV membership is returned, so the number is not a queue order.
  • "Not found" does not mean "not a vulnerability". An ID is reserved before it is published and published before it is analysed. In that window the NVD may hold a description and no score — which is what this tool shows, rather than inventing one. The vendor advisory usually exists first and often rates the same flaw differently.

Read the vector, not the number

  • Two fields decide most triage arguments. AV separates AV:N (anyone who can route to it) from AV:L and AV:P; PR:N means unauthenticated while PR:H means the attacker was already an administrator.
  • Scores from different versions do not compare. This tool prefers v3.1, falls back to v3.0 then v2, and labels which it showed. A v2 7.5 and a v3.1 7.5 are different scales and must never be sorted into one list.
  • The CWE is the half that generalises. CVSS says how bad; CWE says what kind — which tells you whether the same mistake exists elsewhere.

When to use something else

Triage is a different job: ordering many findings against your own exposure and compensating controls. The vulnerability-prioritization prompt refuses to rank on base score alone. To find out what you actually run, host-vulnerability-scanner enumerates services, and ssl-cert-checker covers the TLS half that CVE lists rarely surface well.