Am I affected?
Type a product name — like Apache or nginx — and see the known CVEs that affect it, ranked by real-world risk: CVSS severity, EPSS exploitation probability, whether CISA lists it as actively exploited, and, for products our KEV-Exposure radar tracks, how many internet-facing services (distinct ip:port) it has on record running an affected version — derived from Shodan data, searched every 12 hours when Shodan query credits allow. Free, no signup.
What that looks like across a whole estate
Fifty seconds, narrated. One CVE traced to the exact machines running it — and the two it could not resolve, named rather than hidden. The estate in this recording is fictional — a seeded demo tenant, not a customer. The product is real; the company is not.
How matching works
We match your product against the official NVD CPE data on every CVE in our live feed, then compare your version against each CVE's affected version range. The match is deliberately conservative-correct — when a version range is ambiguous we err toward showing the CVE rather than hiding a real one. Use the software's CPE product token (e.g. http_server for Apache, linux_kernel for the Linux kernel).
Coverage & limits
- • Best for infrastructure & OS software that NVD tracks with CPE version ranges — web servers, databases, libraries, operating systems.
- • A no-match result reflects NVD CPE data for that exact token — it is not a guarantee of safety. Confirm the product token and version.
- • Each result links to its full CVE Pulse page — scores, exploits, patches, and any internet-exposure footprint our KEV-Exposure radar has on record.
- • Want this in your own tooling? The same data is in our free API and MCP server for Claude & Cursor.