CVE Lookup
Look up the publicly known vulnerabilities (CVEs) recorded for a specific piece of software. Enter a product name with an optional version — for example nginx 1.24.0 — or paste a full CPE string, and SysGlass queries the public NVD (National Vulnerability Database) feed and lists the matching CVEs. Each result shows its CVE ID, CVSS score, severity and publication date, with a link to the full NVD record. When you provide a version, matches for that version are marked confirmed; a product-only lookup returns the broader set for you to review.
Reviewed by the SysGlass team · Updated July 21, 2026
Live-scan an IP or host and see what's actually exposed — open ports, services/versions, the CVEs it's affected by, amplification vectors, gateways, TLS/headers.
Open IP / Host Exposure Audit →Look up the known CVEs for a product + version (or CPE) from the NVD database. No host is contacted — you research a piece of software.
nginx with version 1.24.0, OpenSSH 7.4, or a full CPE. To inspect a real IP/host and discover all exposed services, use IP / Host Exposure Audit.What it checks
- Known CVEs published for the named product, drawn from the public NVD vulnerability feed
- The CVSS base score and severity (critical / high / medium / low) for each CVE
- The publication date of each advisory
- The CPE the match was made against, shown in the finding evidence
- Whether a CVE applies to the exact version you entered (marked confirmed) or to the product more broadly (needs review)
- A direct link to the authoritative NVD record (nvd.nist.gov/vuln/detail/<id>) for each finding
How to read the result
- Each finding is one CVE: the message names the ID and summary, the evidence line shows the CVSS score and the CPE matched, and the confidence badge says whether it was version-matched.
- Confirmed — the CVE is recorded against the exact version you entered; treat it as directly applicable and check whether a fixed release exists.
- Needs review — you searched by product without a version (or the version range is broad), so the CVE may or may not affect your build; confirm against your installed version.
- Higher CVSS first: a 9.0+ critical with a public exploit is more urgent than a low-severity issue, but always weigh whether the affected component is actually reachable in your deployment.
- Follow the NVD link on each finding for the authoritative description, the affected version ranges, references and any patch information.
- No CVEs returned doesn't prove the software is safe — it means none are recorded in NVD for the product/version as entered; check the exact product name and version spelling.
Frequently asked questions
Where does the CVE data come from?
From the public NVD (National Vulnerability Database) maintained by NIST — the authoritative US government CVE feed. SysGlass queries it live for the product or CPE you enter and links each finding straight to the matching nvd.nist.gov record so you can read the full advisory.
What should I enter — a product name or a CPE?
Either. The simplest form is a product name with an optional version, such as nginx 1.24.0 or openssl 3.0.2. If you already know the exact CPE (for example cpe:2.3:a:nginx:nginx:1.24.0:*:*:*:*:*:*:*), paste that for the most precise match. Adding a version narrows the results and lets matches be marked confirmed.
What does the confidence badge mean on a CVE finding?
Confirmed means the CVE is recorded against the exact version you supplied, so it applies directly. Needs review means the lookup matched on product (or a broad version range) rather than your specific version, so you should verify it against your installed build before acting.
Does a clean result mean my software has no vulnerabilities?
No. It means NVD has no CVEs recorded for the product and version exactly as you entered them. Vulnerabilities can be unpublished, assigned under a different product name, or filed against a component rather than the product. Double-check the product spelling and version, and keep software patched regardless.
Why does the same product sometimes return many CVEs?
Searching by product without a version returns every CVE ever recorded for that product across all versions, including ones already fixed in your release. Add the specific version you run to narrow the list to the CVEs that are most likely to apply and to get confirmed matches.
What does the CVSS score tell me?
CVSS is a standard 0–10 base score for how severe a vulnerability is, mapped to low / medium / high / critical. It rates the flaw in isolation — it doesn't know whether the affected feature is enabled or reachable in your environment. Use it to prioritise, then confirm exploitability for your actual deployment.