CVE Vulnerability Lookup & CVSS Calculator

Search CVE vulnerabilities, calculate CVSS v3.1 base scores and vectors, and audit security flaws across software libraries.

Showing 20 Curated Landmark Vulnerabilities Curated NVD Offline Catalog

CVE-2021-44228

CRITICAL 10.0

Log4Shell: Apache Log4j JNDI Remote Code Execution

Apache Log4j2 versions 2.0-beta9 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints.

Apache Log4j CWE-502 Deserialization Attack: Network

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Patch: Upgrade to Log4j 2.17.1 or remove JndiLookup class.

CVE-2024-3094

CRITICAL 10.0

XZ Utils / liblzma Upstream Malicious Backdoor

Malicious code was embedded in release tarballs of upstream xz/liblzma versions 5.6.0 and 5.6.1 that intercepts OpenSSH sshd RSA authentication, permitting unauthorized remote pre-authentication access.

XZ Utils CWE-506 Embedded Malicious Code Supply Chain

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Patch: Downgrade immediately to xz 5.4.x stable.

CVE-2022-22965

CRITICAL 9.8

Spring4Shell: Spring Framework ClassLoader Data Binding RCE

Spring Framework MVC and WebFlux applications running on JDK 9+ allow unauthenticated remote code execution through data binding parameter injection into ClassLoader properties.

Spring Framework CWE-94 Code Injection Attack: Network

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Patch: Upgrade to Spring Framework 5.3.18+ or 5.2.20+.

About this tool

How to use it

Search for any CVE identifier (e.g. CVE-2021-44228) or product keyword (e.g. OpenSSL, Apache, Windows, Linux) to view vulnerability details.
Filter the database by severity rating: Critical (9.0-10.0), High (7.0-8.9), Medium (4.0-6.9), or Low (0.1-3.9).
Inspect the Common Weakness Enumeration (CWE) identifier, attack vector, privileges required, and patch remediation notes.
Switch to the interactive CVSS v3.1 Calculator tab to compute base scores, impact vectors, and exploitability ratings for custom vulnerabilities.
Copy standard CVSS v3.1 vector strings directly into bug bounty reports or internal Jira tickets.

Why it matters

Common Vulnerabilities and Exposures (CVE) and the Common Vulnerability Scoring System (CVSS) are the universal language of cybersecurity, software auditing, and incident response. Developers and DevSecOps engineers need fast, client-side reference guides, historical incident data, and accurate CVSS vector scoring without relying on slow or rate-limited external portal APIs.

When to use it

Use when reviewing Dependabot alerts, assessing vulnerability severity for SLA triage, preparing incident post-mortems, or drafting bug bounty submission reports.

Common questions

What is the difference between CVE and CVSS?

A CVE (Common Vulnerabilities and Exposures) is a standardized catalog identifier (e.g., CVE-2021-44228) assigned to a specific publicly disclosed security flaw. CVSS (Common Vulnerability Scoring System) is the numerical scoring framework (0.0 to 10.0) that measures its severity based on exploitability and impact.

What makes a vulnerability Critical (CVSS 9.0 - 10.0)?

A vulnerability reaches Critical severity when it can be exploited remotely across the network (AV:N), with low complexity (AC:L), requiring zero privileges (PR:N) and no user interaction (UI:N), resulting in complete compromise of Confidentiality, Integrity, and Availability.

How does the built-in CVSS v3.1 calculator compute scores?

It implements the official FIRST.org CVSS v3.1 mathematical specification, combining Exploitability sub-scores (Attack Vector, Complexity, Privileges, Interaction) with Impact sub-scores (Scope, Confidentiality, Integrity, Availability) and rounding up to one decimal place.

Does this tool work offline without NIST NVD API access?

Yes! The tool incorporates an extensive curated offline database of 20+ landmark CVEs across major software ecosystems, and provides a full offline CVSS calculator alongside optional live NIST NVD search capabilities.