Free CVE Lookup: Exploitation, KEV Status and Detections

What a free CVE lookup shows you

A CVE identifier on its own tells you almost nothing. It is a label, not a risk assessment. A lookup only earns its place when it answers the four questions a defender actually has: how bad is this flaw, is anyone exploiting it, does it touch anything we run, and can we detect it. This tool answers all four on one screen, with no account and no API key.

Severity — the CVSS base score

CVSS is the severity rating published alongside the vulnerability. The base score runs from 0.0 to 10.0, and the vector string beside it spells out how that score was reached: whether the flaw is reachable over the network, whether it needs privileges or user interaction, and what it costs you in confidentiality, integrity and availability. A lookup returns the CVSS v3.1 score and vector, the v4.0 score where the numbering authority has published one, and the qualitative severity band. Read it as a description of the flaw, not as a queue order.

Likelihood — the EPSS probability

EPSS, the Exploit Prediction Scoring System, estimates the probability that a vulnerability will be exploited in the wild within the next thirty days. It is the number that separates the thousands of critical-rated CVEs nobody ever weaponises from the handful that matter this week. A lookup reports both the raw probability and the percentile against every other scored CVE, so you can see whether a 9.8 sits in the top one percent or the bottom half of real-world risk.

Confirmation — CISA KEV status

The CISA Known Exploited Vulnerabilities catalog is the authoritative public record of vulnerabilities confirmed to be exploited in real attacks. A lookup reports whether the CVE is listed, the date it was added, the federal remediation due date attached to it, and whether CISA has flagged it as used in known ransomware campaigns. A KEV entry moves a vulnerability out of prediction and into fact, and it is the single strongest argument for an out-of-band patch window.

Proof — public exploit code

The lookup surfaces whether public proof-of-concept code exists, how many repositories publish it, whether an Exploit-DB entry is recorded, and whether a Nuclei template has been written for it. Public exploit code compresses the gap between disclosure and mass opportunistic scanning, so its existence can change your patch deadline even when the scores have not moved.

Exposure — affected products and weakness classes

Every trace lists the affected vendors, products and version ranges from the published advisory, the CPE strings you can match against an asset inventory, and the CWE weakness classes the flaw belongs to. Weakness class is the part that generalises: knowing you are looking at a command injection, a path traversal or an unsafe deserialisation tells you which other systems deserve a second look this afternoon.

Context — linked threats, actors and techniques

This is the part a generic vulnerability database cannot do. Threadlinqs joins the identifier back to the curated threat records that reference it, and through those records to the threat actors credited with the activity and the MITRE ATT&CK techniques the campaigns use. The lookup reports how many threat records reference the CVE and which entities hang off them, each one a link into the full intelligence record.

Response — detection coverage

Finally, the trace reports how much detection coverage exists for the linked threats and which query languages that coverage is written in — Splunk SPL, Microsoft Sentinel KQL and Sigma. Coverage counts and language breakdowns are public here; the rule bodies themselves open inside the platform.

A worked example: CVE-2024-3400

CVE-2024-3400 is the command-injection flaw in the GlobalProtect feature of Palo Alto Networks PAN-OS. It is a useful example because every field a lookup can populate is populated, and every value below comes straight from the public record.

Read the row order as a decision. A 10.0 alone would not justify an emergency change window — plenty of 10.0 ratings never get touched. An EPSS probability at the ceiling, a KEV entry with a seven-day federal due date, a ransomware flag and working public exploit code together do. That is the judgement a lookup is supposed to make easy, and it is the same judgement whether the identifier is two years old or two days old.

The full record for this vulnerability, including the curated threats that reference it, sits on the CVE-2024-3400 intelligence page.

Where the data comes from

Vulnerability metadata is assembled from the authoritative public sources rather than restated from memory: the CVE Program record published by the assigning numbering authority, the National Vulnerability Database, the EPSS model published by FIRST, and the CISA Known Exploited Vulnerabilities catalog. Weakness classes come from the MITRE CWE list.

The intelligence layer on top — curated threat records, adversary attribution, MITRE ATT&CK mapping and detection coverage — is Threadlinqs research, refreshed by a nightly ingestion and enrichment run. That means a lookup can tell you not only what the advisory said, but which reported campaigns actually used the flaw and what a detection for them looks like.

Enrichment is applied merge-safely, so a source that goes quiet never blanks a field another source already filled. Each record carries the timestamp of its last enrichment, and identifiers that no source has yet scored are reported as unscored rather than padded with a default.

What a lookup costs, and what comes next

During the launch window every trace is free and open to everyone, no account required. After that the tool is a paid add-on to the Red tier and is included at no extra cost with Purple and Gold, which also carry a seven-day trial. The current figures live on the plans and pricing page.

A single identifier is a starting point, not an answer. When the question grows past one CVE — which of this quarter's vulnerabilities are being exploited against our sector, which adversary is using them, what detections do we already have — that work happens on the wider platform. Read how the intelligence layer is built on the threat intelligence overview, or open the live vulnerability feed to see what is moving right now.