# Vulnerability search

> Vulnerability search is a free lookup for every published CVE, over 400,000 of them. Type an ID to see how severe a flaw is, whether criminals are using it, how likely it is to be used and what it affects. It's for anyone who needs a clear answer quickly, with no account.

Canonical page: https://www.edgeprotect.io/cve-search

## How to look one up

Go to `https://www.edgeprotect.io/what-is/<CVE-ID>` (upper case, like CVE-2024-3400), for example [CVE-2021-44228](https://www.edgeprotect.io/what-is/CVE-2021-44228), [CVE-2024-3400](https://www.edgeprotect.io/what-is/CVE-2024-3400) or [CVE-2023-4966](https://www.edgeprotect.io/what-is/CVE-2023-4966). Only CVE IDs work here (the year, then a number). To browse by product or maker, use the software maker pages below.

Every CVE page shows:

- **Is it being used in attacks?** Whether it's on the government list of exploited flaws, and the action that list asks for.
- **How bad it is.** The CVSS score and what goes into it, explained.
- **How likely it is to be used.** The latest exploit-likelihood score, with its history.
- **What it affects.** The products and versions, the type of weakness and related flaws.

## Just published

The most most recently published CVEs, newest first. The rating beside each score is the CVSS rating (0 to 10), not the EdgeProtect risk score.

The live list is unavailable right now. Look up any CVE by ID using the address above.

## How to read a CVE

**What is a CVE?** A CVE is a public ID for one known security flaw in one piece of software, written like CVE-2024-3400. The ID lets everyone, from the maker to your IT team, talk about the same problem.

**What does the CVSS score tell me?** CVSS rates how bad a flaw could be, from 0 to 10, if someone used it. It describes the flaw in theory. It says nothing about whether anyone is actually using it.

**Why isn't severity enough?** Thousands of flaws score high, and most are never used against anyone. Fixing by severity alone buries the few that criminals are using today. Under 1% of all CVEs reach Critical on our risk score.

**What makes a flaw urgent?** Evidence it's being used in real attacks. Our risk score weighs that first, then severity, exposure and threat activity. Anything confirmed exploited is marked for an emergency patch, whatever its score.

### The EdgeProtect risk score, 0 to 100

Kept up to date for every CVE as the evidence changes.

| Band | Score |
|---|---|
| Critical | 85 and above |
| High | 70 to 84 |
| Medium | 40 to 69 |
| Low | 20 to 39 |
| Info | 0 to 19 |

It considers four things: evidence it's being exploited counts most, then how severe it is, then how exposed it is and threat activity.

## Watch the ones that affect you

Over 400,000 flaws have been published, and new ones arrive every day. A free account turns the whole catalogue into the handful that touch your business, in the order to fix them:

1. **Tell us what you run.** Pick your software from a catalogue, or let us work it out from your website. You check the list before anything is saved.
2. **We match and rank.** Every flaw in that software gets a risk score from 0 to 100, led by evidence that criminals are using it, then how severe it is and how many products it reaches.
3. **You hear about new ones.** An alert by email, in the app or by webhook as soon as we spot a new flaw in something you use.

Free plan, no card needed: https://www.edgeprotect.io/register

## Start somewhere else

- Threat groups: https://www.edgeprotect.io/threat-actors, for example these state-backed groups: [Lazarus Group](https://www.edgeprotect.io/threat-actors/lazarus-group) (North Korea), [APT28](https://www.edgeprotect.io/threat-actors/apt28) and [APT29](https://www.edgeprotect.io/threat-actors/apt29) (Russia), [APT41](https://www.edgeprotect.io/threat-actors/apt41) (China), [APT33](https://www.edgeprotect.io/threat-actors/apt33) (Iran)
- Industries: https://www.edgeprotect.io/industries
- Software makers, for example https://www.edgeprotect.io/vendors/microsoft, https://www.edgeprotect.io/vendors/apache, https://www.edgeprotect.io/vendors/fortinet
- Products, for example https://www.edgeprotect.io/product/microsoft/windows_10, https://www.edgeprotect.io/product/apache/log4j

## Questions people ask

**Do I need an account to search?**
No. You can look up any CVE, threat group, industry or software maker without an account.

**How up to date is it?**
It covers every published CVE, over 400,000 of them, and we keep watching for new ones. The list on this page shows the most recently published.

**What is the EdgeProtect risk score?**
A score from 0 to 100 that we keep up to date for every CVE as the evidence changes. Evidence the flaw is being exploited counts most, then how severe it is, then how widely exposed it is and related threat activity. 85 and above is Critical.

**Can I get told when a flaw affects my software?**
Yes. Tell us the software you use and we match new flaws to it, rank them and tell you as soon as we spot one, by email, in the app or by webhook.

**Can I use this data in my own tools?**
Yes. Our REST API and MCP server for AI assistants cover CVEs, exploitation evidence, threat groups and more.

**Is a high CVSS score the same as high risk?**
No. CVSS describes how bad a flaw could be in theory. Our risk score adds whether it is being used in real attacks, so you can fix the ones most likely to hurt you first.

## Links

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact