VULNERABILITY REFERENCE
Find the facts behind a CVE.
Search new disclosures and the historical archive. Check affected products, exploitation signals, and the sources behind each finding.
Recent reports refresh daily; the historical archive refreshes weekly. Daily updates take precedence when a CVE appears in both. Open a result for affected versions, source references, and available PoC or detection resources.
Severity is not likelihood
CVSS describes technical severity. EPSS estimates exploitation probability over the next 30 days. Neither establishes whether your particular system is affected.
Known exploitation
CISA KEV records exploitation in the wild. It is a distinct signal from a public PoC, and deserves attention even when exploit code is not catalogued.
Follow the source
Exploit code, detection templates, and discovery links are labelled separately on CVE pages. A GitHub search link is a starting point, not a verified PoC.