b2KIT

CVE Lookup Tool

Search and browse Common Vulnerabilities and Exposures entries with severity scores and affected products.

Tested tool guide Tested browser tools Checked August 16, 2026

What CVE Lookup Tool does and how it behaves

Look up a known CVE identifier or search CVE records to identify vulnerabilities associated with a product. The tool presents the record description, available severity score, and affected-product information so you can decide which advisory needs closer review. A CVE match does not prove that a particular installation is vulnerable. Product naming, version ranges, configuration, platform, and installed fixes still have to be compared with the system in question.

How the result is produced

1

CVE identifier and record search

Use a complete identifier such as CVE-2021-44228 when you already have a CVE number. A broader search helps browse possible records when you begin with a product or vulnerability term. Results are CVE entries, not detections from the user's computer. The lookup does not inspect installed software, running services, configuration, or network exposure.

2

Severity and affected products

A result associates the CVE description with any displayed severity score and affected-product data. Read product names and version statements literally because similar editions, forks, operating systems, or package builds may not share the same status. A CVSS score describes technical severity using defined metrics. It is not a probability that exploitation will occur.

Good uses

  • Expand a CVE number from a security bulletin into its description, severity, and affected-product details.
  • Review whether CVE records mention a product represented in a patch or vulnerability-management backlog.
  • Find candidate CVE identifiers for a product before checking the vendor advisory and the deployed version.

Limits and checks

  • Do not treat an affected-product match as confirmation that your exact package, edition, platform, or configuration is vulnerable.
  • Severity data can differ by CVSS version, metric choices, source, or later revision, so compare more than the displayed number.
  • A CVE record does not establish whether a system is reachable, exploitation has occurred, or a mitigating patch is already installed.

Common questions

Does a high severity score mean the vulnerability will be exploited?

No. A CVSS score summarizes technical severity from defined metric values. It does not measure your asset's importance, how widely the vulnerable feature is deployed, whether attackers are currently exploiting it, or whether controls reduce exposure. Combine the record with vendor guidance, deployment context, and current threat information when prioritizing work.

Can this lookup tell whether my computer is vulnerable?

No. It returns published vulnerability information rather than examining the device. Confirmation requires identifying the installed product and version, checking platform and configuration conditions, and determining whether the relevant fix or mitigation is present. Vendor advisories are often needed because package revisions and backported fixes may not align neatly with upstream version numbers.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools