Free CVE Lookup · Updated Hourly · No Account Needed
CVE Database 2026 — Search Security Vulnerabilities
Search and track 200,000+ publicly disclosed CVEs (Common Vulnerabilities and Exposures) with CVSS severity scores, EPSS exploit probability scores, and CISA Known Exploited Vulnerabilities (KEV) flags. Find any CVE by ID, vendor, product, or keyword — updated every hour from authoritative sources, free with no sign-up.
New to CVEs? Read our guide to CVE, CVSS & EPSS · Actively exploited only? View CISA KEV list →
200,000+
CVEs indexed
Hourly
Updated
1,200+
CISA KEV tracked
Free
Access
No CVEs match this filter.
Clear filter and show allData via Shodan CVEDB. Updated hourly. For context on scoring, read Understanding CVE & CVSS.
CISA KEV TrackerAbout the Pentevo CVE Database
What is this CVE database?
Pentevo's CVE database is a free, real-time vulnerability tracker that indexes every CVE published by MITRE and CVE Numbering Authorities (CNAs). Each entry shows the CVSS v3.1 base score, the EPSS exploit probability, and a live CISA KEV flag indicating whether the vulnerability is actively exploited in the wild. No account or API key required — search directly from this page.
How is it different from NVD?
The NIST National Vulnerability Database (NVD) is the authoritative source for CVE data, but it can lag days or weeks on enrichment. Pentevo pulls directly from Shodan CVEDB and updates hourly, meaning new CVEs typically appear within 60 minutes of public disclosure — faster enrichment for security teams that need to act quickly. EPSS scores and CISA KEV flags update in real time as new data is released.
Who uses CVE databases?
Security operations teams use CVE databases to prioritize patching by correlating CVSS severity with EPSS exploit probability. Penetration testers look up CVEs for specific software versions during reconnaissance. Bug bounty hunters cross-reference CVEs against in-scope targets. Compliance teams track KEV status to meet CISA patch-by deadlines and demonstrate due diligence under frameworks like SOC 2 and ISO 27001.
How to use CVSS + EPSS together
CVSS measures theoretical severity — a score of 9.8 means the vulnerability is critically dangerous if exploited. EPSS measures real-world probability of exploitation in the next 30 days. Prioritize CVEs that are both high-CVSS and high-EPSS, or any CVE on the CISA KEV list regardless of CVSS score. A medium-CVSS CVE with 85% EPSS is more urgent than a Critical with 0.1% EPSS.
CVE Database — Frequently Asked Questions
What is a CVE?
CVE stands for Common Vulnerabilities and Exposures — a standardized identifier for publicly known cybersecurity vulnerabilities. Each CVE entry has a unique ID (e.g. CVE-2026-12345), a description of the security flaw, and references to advisories and patches. CVEs are assigned by MITRE and a global network of CVE Numbering Authorities (CNAs) including major vendors like Microsoft, Google, and Red Hat.
What does the CVSS score mean?
CVSS (Common Vulnerability Scoring System) rates vulnerability severity from 0 to 10. Critical (9.0–10) vulnerabilities are the most dangerous and typically allow remote code execution without authentication. High (7.0–8.9) are serious and should be patched quickly. Medium (4.0–6.9) require specific conditions. Low (0.1–3.9) have minimal impact. Most security teams prioritize Critical and High CVEs first.
What is the CISA KEV list?
The CISA Known Exploited Vulnerabilities (KEV) catalog is a list of CVEs that US cybersecurity agency CISA has confirmed are actively exploited by real attackers in the wild. US federal agencies must patch KEV vulnerabilities within 15–25 days. It's the world's most authoritative list of vulnerabilities being actively weaponized — even private organizations use it to prioritize patching.
What is EPSS and how is it different from CVSS?
EPSS (Exploit Prediction Scoring System) predicts the probability a CVE will be exploited in the next 30 days, ranging from 0% to 100%. CVSS measures theoretical severity; EPSS measures real-world exploit likelihood. A CVE can have a medium CVSS score but very high EPSS — meaning attackers are actively exploiting it despite it not being rated "Critical". Using both together gives a much better picture of which vulnerabilities to patch first.
How often is this CVE database updated?
Pentevo's CVE database is refreshed every hour, pulling the latest disclosures from Shodan CVEDB. CISA KEV flags are also updated as soon as new entries are added to the official KEV catalog. This means you typically see new CVEs within 60 minutes of public disclosure.