// tool reference · Vulnerability & Assessment

CVE Lookup Free

NVD で CVE を検索します：深刻度、CVSS、影響を受ける製品、防御側の緩和策。

What it does

Resolves a CVE identifier to its description, CVSS severity and — critically — whether CISA lists it as known-exploited.

When to use it

A scanner reported a CVE and you need to know if it is theoretical or actively exploited.

Inputs

Field names are the actual form parameters, verified against source.

Field	種類	Required	Notes
cve	text	required	CVE ID, e.g. CVE-2026-1234.

What you get back

Description, CVSS, references, KEV status.

活用例

Input

CVE-2021-44228

Output (abridged)

CVE-2021-44228 -- Log4Shell
  CVSS     10.0 CRITICAL
  KEV      YES -- added 2021-12-10
  Affects  Apache Log4j 2.0-beta9 -> 2.14.1

  Remote code execution via JNDI lookup in a logged string. Trivially
  exploitable: an attacker only needs their input to reach a log call.

  KEV = exploited in the wild. That single field should dominate your
  patch order far more than the CVSS number beside it.

How it works

Deterministic lookup against NVD and CISA KEV data.

Limits

Read live from the platform configuration.

Rate limit

30 requests / 60s (platform default)

Limitations — what it does なし do

It reports published data. A vulnerability with no CVE, or one published after the last feed refresh, will not appear.

プライバシー

Nothing is stored.

Standards

CVECVSSCISA KEV