How to find out which vulnerabilities you actually have

There are over 340,000 published CVEs, and more land every day. Scroll any feed and it's a wall of severity badges. But almost none of them are your problem — and the ones that are, you can rarely confirm on the spot. That gap, between "a scary CVE exists" and "am I actually affected?", is where most teams get stuck. This is how cve.tools closes it — and why closing it once is never enough.

The hard part isn't finding CVEs. It's knowing which ones are yours.

A CVSS score tells you how bad a vulnerability is in theory. It says nothing about whether the affected software is running on your network, in a version that's exploitable, exposed in a way an attacker can reach. Answering that by hand — read the advisory, find the affected builds, figure out how you'd even test for it — is slow, and it's exactly the work people skip when they're busy. So real risk sits unconfirmed.

Every CVE now tells you whether you can check it

For each vulnerability we track, we link it to the actual detection content the security community has published — the tests that prove whether a system is affected. Two engines feed this: Nuclei templates (fast, remote checks you run from anywhere) and OpenVAS / Greenbone NVT scripts (the deep, broad scanner engine). Wire those to our CVE data and you get a simple, honest answer on every page: can this one be verified, and how?

That's about 150,000 CVEs you can self-check today — a real, live count from the templates and NVTs mapped to each CVE. Around 1,500 of them are on CISA's Known Exploited Vulnerabilities list: bugs attackers are using right now, and the ones you most want to confirm you're clear of.

Check it yourself — in one command

Open any CVE (or go straight to the checker and type a CVE ID) and you'll find a "How to verify you're affected" section. It's not a wall of YAML — it's a procedure. We pick the most trustworthy template (official ProjectDiscovery templates rank first), build the exact detection command for you, and show it copy-ready:

• Nuclei — a single, copy-paste command that points a battle-tested check at your own host, with safe rate limits already set. Run it, read the result: affected or not.
• OpenVAS — the NVT OID is the actionable payload. Enable that check in your Greenbone scan config, or confirm it's in your feed with the query we hand you.
• References checklist — the advisories and affected-build notes you need to sanity-check the result, one click away.

Nuclei or OpenVAS — which check applies?

And you don't add these two up — you combine them. OpenVAS covers about 120,000 CVEs and Nuclei about 40,000, but only around 4,000 carry both a template and an NVT. So they're complementary, not redundant: OpenVAS brings roughly 115,000 checks Nuclei never had, Nuclei adds its fast remote checks on top, and together they reach about 150,000 CVEs you can verify — far more than either engine alone. Each CVE page shows a scanner-coverage badge telling you at a glance whether a fast Nuclei one-liner, a full OpenVAS scan, or both will confirm it — before you spend a minute setting anything up.

But a scan only tells you about one moment

Here's the trap nobody warns you about. A scan is a photograph: it answers "of the things I pointed the scanner at, right now, which are vulnerable?" That's genuinely useful — and it starts going stale the second it finishes, because the thing it measured isn't standing still. Your external attack surface is a movie, not a snapshot.

• Your perimeter drifts — fast. Palo Alto's Unit 42 found that roughly 20% of an organization's critical cloud infrastructure changes every month. A month-old scan is already out of date across a fifth of your estate.
• Attackers move faster than your scan schedule. VulnCheck found ~29% of newly known-exploited bugs in 2025 were hit on or before the day they went public. Verizon's 2025 DBIR puts exploitation behind ~20% of all breaches, up about 34% year over year — concentrated on exactly the internet-facing edge devices and VPNs a quarterly scan misses between runs.

The bigger problem: you can only test what you know is there

Now the part that quietly sinks most self-assessments. A scanner only ever looks at the targets you hand it — and the assets you know about are almost never the same list an attacker can reach. Somewhere out there is a staging box someone spun up "just for a demo," an old marketing subdomain still pointing at a live server, a forgotten API gateway, a dev login exposed "temporarily" two years ago. You will never scan any of it, because it was never on your list. Teams that finally look from the outside routinely find around 35% more internet-facing assets than they were tracking — and Gartner expects most employees to be standing up technology outside IT's view by 2027. The shadow surface you can't see is exactly what a scoped scan skips.

So real external testing doesn't start with a scanner. It starts with reconnaissance — the same OSINT an attacker runs before touching you. You enumerate everything the organization actually exposes: subdomains and DNS records, WHOIS and registrant footprints, certificate-transparency logs, netblocks and ASNs, then the open ports and live services on each. Only once you've mapped the true surface — including the parts nobody remembered — does it make sense to point automated vulnerability checks at each asset. Discover first, validate second. Skip the discovery and you're just re-confirming the safety of the assets that were never the problem.

For one asset on a quiet afternoon, that two-step is easy. Now do it for an estate that's really tens, hundreds, or thousands of hosts and domains — most of them drifting. Discovery has to run continuously, because assets appear and vanish weekly. Every newly found asset needs its own battery of checks. And the whole loop has to repeat, because a result from last week is already stale. At that scale it stops being a task and becomes an infrastructure problem: real scanning horsepower, scheduling, credential handling, rate-limiting so you don't knock services over, and a human to triage what comes back. That's the honest limit of manual, point-in-time testing — it can always tell you about one asset at one moment. Turning it into continuous, whole-perimeter coverage is a genuinely hard, resource-hungry process. Which is precisely why most teams shouldn't try to run it in-house.

From a one-off scan to always-on validation

If you defend real infrastructure, the goal was never "pass a scan." It's to keep knowing what you expose and what's actually exploitable, as it changes. That's a ladder security teams climb, one rung at a time:

1. Manual scanners — Nuclei, OpenVAS, Nessus, Nmap. Powerful, cheap, and point-in-time. The right first rung, and where our free per-CVE self-check lives.
2. Scheduled scanning — the same tools on a cadence. Better than a yearly audit, but still blind to anything that isn't in the scan's scope.
3. EASM (External Attack Surface Management) — continuous, outside-in discovery of your internet-facing assets, including the ones you forgot. Gartner named this market in 2021 precisely because "find the surface before you scan it" is its own problem.
4. Continuous validation / CTEM — the top rung goes past "a scanner flagged it" to "an attacker could actually reach and exploit this, verified continuously." Gartner's Continuous Threat Exposure Management model builds validation right into the loop, and pairs it with live signals like KEV and EPSS so you chase what's genuinely dangerous, not every theoretical finding.

You don't have to buy an enterprise platform to start climbing. The free lookup gets you rung one today; the sections below are how cve.tools carries you up the rest — either by aiming it at what you run, or by handing the whole thing to us.

Point it at what you actually run — and keep it pointed

Checking one CVE is useful. The real win is flipping the question around and keeping it flipped: of everything I run, what should I be checking — today, and tomorrow, and next week? Create a free account, add your products to My Stack — by hand, from a CSV, or pushed from the cvetools CLI — and we match every new CVE against your inventory automatically, continuously.

• See new vulnerabilities that hit your vendors and products the day they land — not a global firehose.
• In the triage console, make an ACT / DEFER call on each one and it sticks, with the risk frozen as audit evidence.
• The console flags your blind spots — findings marked ACT that no scanner can even detect — so you know exactly where a self-check won't save you and hands-on review is the only option.
• When a bug you deferred later gets a public exploit or lands on KEV, we reopen the alert. The watch doesn't stop when you close the tab.

Or hand the whole thing to us — continuously

This is the honest recommendation for most teams — not a bolted-on pitch. The discover-then-validate loop, run continuously at scale, is real infrastructure work, and even the UK's national cyber agency now publishes a buyer's guide for continuous external attack-surface monitoring as a capability you purchase, not a tool you babysit. So point us at your domain and we'll run a complimentary external exposure review: we do the reconnaissance the way an attacker would — mapping every asset you expose, including the ones you forgot — then validate what's actually exploitable. No software to install, no obligation.

1. We review your domain — typically within 1–2 business days.
2. We conduct the review — external assets, security findings, forgotten systems and publicly exposed credentials.
3. We share the findings — a walkthrough with prioritized, plain-language recommendations.

And because one look at a moving target is exactly the trap we just described, it doesn't have to end there. The review is the start of an ongoing watch: between check-ins, your Stack keeps matching new CVEs to your products and flagging what changed since you last looked. That's the whole point — you get to stop refreshing vulnerability sites and let the checking run continuously, in the background, on someone else's clock.

Start in the next two minutes

Curious about a specific vulnerability that's been in the news? Look it up and see if you can confirm it yourself — no login required.