CVE Search¶
Sidebar: Hunt & Explore → CVE Search · Path: /cve-search · Sign-in required
CVE Search answers two questions: "What do we know about this vulnerability?" and "What should I patch first?"
Patch Priority¶
Before you search, the page shows Patch Priority: CVEs from the TI Mindmap HUB corpus that are listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, ranked by EPSS exploitation probability (top 15). A chip shows how many KEV CVEs are in the corpus.
| Column | Meaning |
|---|---|
| # | Rank |
| CVE ID | Identifier |
| Severity | CVSS v3 severity |
| Exploitation | KEV listing and EPSS probability |
| Risk | Composite 0–100 score combining CVSS, EPSS, KEV, and reported exploitation |
| Due Date | CISA KEV remediation due date |
| Threat Actors | Actors associated with the CVE in the corpus |
| Articles | Number of reports mentioning the CVE |
Searching¶
- Enter a CVE ID (for example,
CVE-2024-3400) or a keyword — vendor, product, or description text (for example,Microsoft,remote code execution) — in CVE ID or Keyword - Click Search
Example chips (CVE-2024-3400, CVE-2021-44228, Microsoft, Apache, remote code execution) fill in sample searches.
Results¶
The header reports how many CVEs matched. Summary chips highlight N in KEV and Contains Critical. Toggle Only CISA KEV to keep only KEV-listed CVEs.
| Column | Meaning |
|---|---|
| CVE ID | Identifier |
| Severity | CVSS v3 severity |
| Exploitation | CISA KEV listing and EPSS probability |
| Status | 🔥 Exploited · 🔧 Patched · 💻 PoC available |
| Affected Products | Vendor / product |
| Articles | Number of reports mentioning the CVE |
Expand a row to see the description, CVSS Vector, Published date, references, and the list of reports that mention the CVE — each one opens the Report View.
Reading the Signals¶
| Signal | What it tells you | Source |
|---|---|---|
| CVSS | Technical severity if exploited | NVD / vendor scoring |
| EPSS | Probability of exploitation in the next 30 days | FIRST EPSS |
| KEV | Confirmed exploitation in the wild, with a remediation due date | CISA KEV catalog |
| Exploited / PoC / Patched | Exploitation and remediation status reported across the corpus | Report content + enrichment |
| Articles | How much the CVE is being discussed in threat reporting | TI Mindmap HUB corpus |
A high CVSS score with low EPSS and no KEV listing is usually less urgent than a medium CVSS score that is KEV-listed with high EPSS.
How It's Generated¶
- CVE identifiers are extracted from each report by pattern matching, so they are exact
- Each CVE is enriched with CVSS, EPSS, CISA KEV status, and exploit/patch/PoC signals from the respective public sources
- The Risk score is computed by the platform, not by an LLM
- The per-report Context text (in the report's CVEs tab) and associated actors/malware come from the AI analysis of the report and should be checked against the source
See CVE Intelligence and How Content Is Generated.
Via MCP¶
Use search_cve, search_cves_by_keyword, list_cves, get_cves_by_article, and get_cve_statistics from an AI assistant. See MCP Server.