Sign inStart freeBook a demo

Look up any flaw.
Understand it fast.

Vulnerability search is a free lookup for every published CVE, over 400,000 of them. Type an ID to see how severe a flaw is, whether criminals are using it, how likely it is to be used and what it affects. It’s for anyone who needs a clear answer quickly, with no account.

  • 400,000+ published CVEs
  • 0 to 100 risk score on each
  • Continuous checks for new flaws
Latest CVEs

Just published. Newest first.

The flaws most recently given a CVE ID. Filter them, then open any one for the full picture.

Showing 8 of the 20 most recently published · 2 with a CVSS score of 7 or above

  1. 6.4CVE-2026-11328CVSS Medium7 Jul 2026The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title parameter in all versions up to, and including, 2.7.9.8 due to insufficient…
  2. –CVE-2026-53648Not scored yet7 Jul 2026FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.1, downloadable product files are stored using a deterministic filename-derived path. When an…
  3. –CVE-2026-53647Not scored yet7 Jul 2026FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is accessible without authentication. Any…
  4. –CVE-2026-13356Not scored yet7 Jul 2026A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to…
  5. 5.0CVE-2024-56141CVSS Medium7 Jul 2026Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the CryptManager encryption routine (…
  6. –CVE-2026-53646Not scored yet6 Jul 2026FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `ClientPasswordReset` record already exists for a client (from a previous unexpired…
  7. –CVE-2026-53645Not scored yet6 Jul 2026FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to itself through the admin…
  8. –CVE-2026-53644Not scored yet6 Jul 2026FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticated clients to both read and reset API key service secrets for orders that are no…
Your estate

This list is for everyone. Yours should be shorter.

Over 400,000 flaws have been published, and new ones arrive every day. Almost none of them touch your business. A free account turns the whole catalogue into the handful that do, in the order to fix them.

  1. 1Tell us what you runPick your software from a catalogue, or let us work it out from your website. You check the list before anything is saved.
  2. 2We match and rankEvery flaw in that software gets a risk score from 0 to 100, led by evidence that criminals are using it, then how severe it is and how many products it reaches.
  3. 3You hear about new onesAn alert by email, in the app or by webhook as soon as we spot a new flaw in something you use.
Start free →Book a demo
The basics

How to read a CVE. Four questions.

They answer most of what you need to know about any flaw. Each CVE page answers them for you.

What is a CVE?

A CVE is a public ID for one known security flaw in one piece of software, written like CVE-2024-3400. The ID lets everyone, from the maker to your IT team, talk about the same problem.

What does the CVSS score tell me?

CVSS rates how bad a flaw could be, from 0 to 10, if someone used it. It describes the flaw in theory. It says nothing about whether anyone is actually using it.

Why isn’t severity enough?

Thousands of flaws score high, and most are never used against anyone. Fixing by severity alone buries the few that criminals are using today. Under 1% of all CVEs reach Critical on our risk score.

What makes a flaw urgent?

Evidence it’s being used in real attacks. Our risk score weighs that first, then severity, exposure and threat activity. Anything confirmed exploited is marked for an emergency patch, whatever its score.

Browse

Don’t know the ID? Start somewhere else.

Look up threat groups, industries and software makers too. No account needed.

Threat groups

Well-known state-backed groups: who they are, where they’re from and how they work.

All threat groups

Industries

Which groups are known to target each sector.

All industries

Software makers

Every known flaw for a vendor or product, with the ones being exploited picked out.

Over 37,000 vendors and 180,000 products covered
FAQ

Vulnerability search, answered.

Something else? Talk to the team →

No. You can look up any CVE, threat group, industry or software maker without an account.

It covers every published CVE, over 400,000 of them, and we keep watching for new ones. The list on this page shows the most recently published.

A score from 0 to 100 that we keep up to date for every CVE as the evidence changes. Evidence the flaw is being exploited counts most, then how severe it is, then how widely exposed it is and related threat activity. 85 and above is Critical.

Yes. Tell us the software you use and we match new flaws to it, rank them and tell you as soon as we spot one, by email, in the app or by webhook.

Yes. Our REST API and MCP server for AI assistants cover CVEs, exploitation evidence, threat groups and more.

No. CVSS describes how bad a flaw could be in theory. Our risk score adds whether it is being used in real attacks, so you can fix the ones most likely to hurt you first.

Get started

Stop reading the whole list. Start with yours.

A free account matches new flaws to the software you use, ranks them and tells you as soon as we spot one in your software.

Free plan, no cardNothing to installOr book a demo →