Protego field desk
PROTEGO

Loading CVE Lookup…

What the CVE Lookup does

The Protego CVE Lookup searches the NIST National Vulnerability Database (NVD) by CVE ID, such as CVE-2021-44228, or by keyword, such as a product or vendor name. Each result shows the official description, the best available CVSS 4.0, 3.1, 3.0 or 2.0 score, its source and vector, KEV and EPSS signals, the published and last-modified dates, and up to 10 reference links.

Searches are sent from Protego to the public NVD API, so you do not need an NVD API key or an account. Use it to check how serious a vulnerability from a scanner report, vendor bulletin or news story actually is, and to find the advisories and patches linked to it.

How to use it

  1. Type a full CVE ID in the format CVE-YYYY-NNNN for an exact match, or a keyword such as "log4j" or "openssh" to search CVE descriptions.

  2. Press Search, or click one of the notable CVE chips (Log4Shell, Heartbleed, EternalBlue and others) to see a worked example.

  3. Read the score and severity badge at the top of each result card, then the vector, complexity and privileges line underneath the description.

  4. Open a result to read references, vendor advisories and patch guidance.

How to read a CVE result

Base score and severity

The 0 to 10 score describes how bad the flaw is in general, not how risky it is for you. A 9.8 Critical in software you do not run is irrelevant, while a 6.5 Medium on an internet-facing VPN gateway may deserve attention first.

Attack vector and privileges

NETWORK with privileges NONE means an unauthenticated attacker can reach the flaw remotely, which is the combination most often exploited at scale. LOCAL or PHYSICAL vectors, or HIGH privileges required, usually mean the attacker already needs a foothold.

UNKNOWN severity

The tool reads CVSS 4.0, 3.1, 3.0 and 2.0 metrics. CVEs without an available assessment show UNKNOWN with no number. Use the vendor advisory in the references instead.

What to do next

Confirm whether your version is affected using the vendor advisory, check whether the CVE is in the CISA Known Exploited Vulnerabilities catalog, then patch or apply the documented mitigation, starting with systems exposed to the internet.

Frequently Asked Questions

What is a CVE?
CVE (Common Vulnerabilities and Exposures) is a standardized identifier for publicly known security vulnerabilities. Each CVE has a unique ID, description, and CVSS severity score provided by NIST or a CVE Numbering Authority.
What does CVSS score mean?
CVSS (Common Vulnerability Scoring System) is a 0-10 numeric score for vulnerability severity: 0.1-3.9 is Low, 4.0-6.9 is Medium, 7.0-8.9 is High, 9.0-10.0 is Critical.
Where does this CVE data come from?
This tool queries the NIST National Vulnerability Database (NVD), the authoritative US government repository of CVE data. Results are cached for up to six hours; CISA KEV is cached for twelve hours.
What is the difference between CVE and CWE?
CVE identifies specific vulnerability instances in software products. CWE (Common Weakness Enumeration) describes the category of weakness, such as SQL injection or buffer overflow.
Why does a keyword search show only 10 results?
The tool asks NVD for the first 10 matches so results load quickly. The total number of matches is shown above the list. To narrow it down, search for a more specific term, such as the product name together with a version or component.
Why does a new CVE show UNKNOWN severity or no score?
A CVE ID is often published before NVD analysts add CVSS metrics, so recent entries can appear with a description only. This tool prefers CVSS 4.0, then 3.1, 3.0, and 2.0, and shows the assessment source. In both cases, check the vendor advisory in the references for its own rating.
Does a high CVSS score mean I have to patch it first?
Not on its own. CVSS rates the technical severity of a flaw in general. Prioritize by combining it with your exposure (is the affected system reachable from the internet), how important the asset is, and whether the flaw is being exploited in the wild, for example if it appears in the CISA Known Exploited Vulnerabilities catalog.