CVEs

Part ofResearch a threat or a vulnerability

The CVEs page lets you browse and search SPECTER's catalogue of published vulnerabilities. You can look up a CVE by its ID, find the CVEs recorded for a product, and open a CVE to see its scores, known exploitation, affected versions and references.

Who can do this

Everyone with access to SPECTER can browse, search and open CVEs. Nothing on this page changes the catalogue.

Browse the catalogue

In the navigation, choose CVEs. The page opens without loading anything. It shows "Search the CVE catalogue" and "Search by complete CVE ID, exact vendor/product or CPE string, or browse the newest published CVEs." The status line reads "Search or browse to load CVEs".

Choose Browse newest CVEs.

Wait while SPECTER shows "Searching the published CVE catalogue…". A large catalogue can take a little while to load.

The page lists the catalogue with the most recently published CVEs first. The line above the table shows how many CVEs match and how they are sorted, in the form "_N_ CVEs · Published descending". Use Previous and Next to move through the results, 30 CVEs at a time.

The CVEs page listing the catalogue, newest published first

The table has five columns: CVE ID, Published, CVSS (the score from 0 to 10), Severity and Status. Status shows whether the CVE is ACTIVE, REJECTED or WITHDRAWN.

Search for a CVE or a product

The search box on this page searches the whole catalogue, not only the CVEs on screen. Typing alone does not search; you start the search yourself.

In the search box (CVE ID or vendor/product), type one of the following:

a complete CVE ID, for example CVE-2021-44228;

a vendor and product, separated by a slash, for example apache/log4j. Use the vendor and product names as they appear in CPE identifiers; the search looks for an exact match;

a complete CPE string, for example cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*. You can also build one with the CPE filter (see below).

Press Enter or choose Search catalogue (the magnifying-glass button).

Wait for the results. The line above the table shows how many CVEs were found.

The CVEs page after a search for one CVE ID

To go back to browsing the whole catalogue, clear the search box and press Enter.

Watch: searching for a CVE and opening it (about 30 s)

Sort and filter the results

Each column heading is a sort button. The arrow next to the heading shows the current order: ↓ for descending, ↑ for ascending, and ↕ for a column that is not used for sorting. Choose a heading to sort by it; choose it again to reverse the order. Sorting by Severity orders the CVEs by their CVSS score. CVEs that have no value in the sorted column are listed last.

Under each heading is a filter:

Column	Filter	How it matches
CVE ID	Type part of an ID, for example `2024`	CVE IDs that contain the text
Published	Type a year and month (`2024-05`) or a date (`2024-05-14`)	CVEs published in that month or on that date
CVSS	Type a Min and/or Max score from 0 to 10	CVEs whose score is within the range. CVEs without a score are left out.
Severity	Choose All, CRITICAL, HIGH, MEDIUM, LOW or NONE	CVEs with that severity
Status	Choose All, ACTIVE, REJECTED or WITHDRAWN	CVEs with that status

A typed filter is applied shortly after you stop typing, or straight away when you press Enter. Filters and sorting work together with your search: for example, search for apache/log4j, then set Severity to CRITICAL. When you leave the CVEs page, the search, sort and filters are reset.

Filter by product with a CPE

A CPE (Common Platform Enumeration) name identifies a product, and optionally a version, in a standard way. The CPE filter finds the CVEs whose recorded applicability matches that product.

Choose CPE in the toolbar. The product filter opens.

Choose how you want to enter the product:

Build from product: choose the Product type (Application, Operating system or Hardware), then enter the Vendor and Product, for example apache and log4j. Version and Target software are optional; leave them empty to match any version or platform.

Paste CPE: paste a complete CPE string. Both CPE 2.3 and CPE URI formats are accepted, and the string must name a specific vendor and product.

Check the preview of the CPE string at the bottom of the filter.

Choose Search CPE (the magnifying-glass button in the filter).

The CPE product filter built for apache / log4j, with the matching CVEs below

The CPE button now shows the product you filtered on, for example "apache / log4j · Any version", and the line above the table adds "Applicability criteria matches". To remove the product filter, choose Clear product filter (the × button in the filter). Press Escape to close the filter without changing it.

Note

A CPE search considers at most 500 product criteria. If the product has more, SPECTER shows "Search reached the 500-criterion limit. Narrow the CPE or search by CVE ID." Add a version, or search for a specific CVE ID.

Open a CVE

In the results, choose the CVE ID.

The CVE record opens. While SPECTER fetches the full details it shows "Loading published CVE source details…".

The record of CVE-2021-44228 with its scores, exploitation notice and assessments

The record starts with four summary figures: CVSS, Severity, Published and Status. Below them you find the sections for which the catalogue has information:

Section	What it shows
Overview	The description of the vulnerability
Known exploitation · CISA	Shown when the CVE is in CISA's catalogue of known exploited vulnerabilities: Vulnerability, Added to catalogue, Action due, Required action and Source
CVSS assessments	One card per published score, for example "CVSS 3.1 · 9.8 · CRITICAL", with an expandable Impact & exploitability part
Decision & publisher assessments	Assessments such as a stakeholder decision (SSVC), the known-exploited status (KEV) and the publisher's own assessment
Weaknesses · CWE	The weakness types behind the vulnerability, with links to the CWE website
Products & version statements	The affected products, with versions and status changes
CPE search match	After a CPE search: how this CVE matched your product
CPE applicability	Collapsed. The full applicability configurations, with their AND/OR conditions, exclusions and environment requirements, and version bounds such as From (inclusive) and Before (exclusive)
Remediation & impact	Remediation advice and impact information from the publishers
Timeline	Dated events in the life of the CVE
Credits	The people and organisations credited with the finding
References	Links to advisories and other sources. Choose Show _N_ more to see the rest.
Publication & source context	When the CVE was published and last modified, its analysis status, who assigned it, and any conflicting states between sources
Source descriptions	Collapsed. The description as each source published it

Important

"A listed CPE alone does not establish applicability." Read the conditions under CPE applicability before you conclude that a product is affected.

Note

For your own hosts, ATLAS does this for you: it checks CPE applicability automatically when it links a CVE to a product it observed. See The stages.

Close the record with the close button in its top-right corner.

Troubleshooting

Message	What it means	What to do
"Enter a complete CVE ID, such as CVE-2021-44228."	The search started with "CVE" but is not a complete ID.	Type the full ID, including the year and the number.
"Search by CVE ID, vendor/product, or a full CPE string."	The search text is not in one of the accepted forms.	Use a CVE ID, `vendor/product`, or a complete CPE string.
"No matching CVEs" / "No matching CVEs in the current catalogue. Search by complete CVE ID or exact vendor/product; clear the search to browse."	Nothing matches your search and filters.	Check the spelling of the vendor and product, loosen your filters, or clear the search to browse.
"Enter both a vendor and product."	The CPE builder needs a vendor and a product.	Fill in Vendor and Product.
"Paste a CPE 2.3 string or CPE URI beginning with cpe:/."	The pasted text is not a CPE string.	Paste a string that starts with `cpe:2.3:` or `cpe:/`.
"Enter a valid CPE 2.3 or CPE URI string."	The CPE string could not be read.	Check the string, or use Build from product instead.
"CPE searches require a specific vendor and product."	The CPE string uses a wildcard for the vendor or product.	Name the vendor and product.
"Search reached the 500-criterion limit. Narrow the CPE or search by CVE ID."	The product has too many criteria to search in one go.	Add a version, or search by CVE ID.
"CVSS filters must be numeric." / "CVSS filters must be between 0 and 10." / "Minimum CVSS must not exceed maximum CVSS."	The CVSS filter values are not valid.	Enter numbers from 0 to 10, with Min no higher than Max.
"Search input is too long."	The search text is too long.	Shorten it.
"The CVE search is still running. Try refreshing shortly."	The search took longer than the page waits.	Wait a moment, then search again.
"Could not load additional CVE details: …"	The full details of the CVE could not be fetched. The summary is still shown.	Close the record and open it again.

SPECTER overview

Threat intelligence: adversaries, techniques and malware

← PreviousThreat intelligence: adversaries, techniques and malware Next →Sources and source health