Question 1

How do I search CVEs for a software component?

Accepted Answer

Enter the component name (e.g. log4j-core), version (e.g. 2.14.1), select the ecosystem (Maven, npm, PyPI etc.) and click SCAN. The engine queries NVD, OSV.dev, GitHub Advisories, and CISA KEV in real time.

Question 2

What is the latest version of log4j?

Accepted Answer

As of 2026, the latest stable version of Apache Log4j 2 (log4j-core) is 2.24.3. CVE-2021-44228 (Log4Shell, CVSS 10.0) affects versions 2.0-beta9 through 2.14.1. Upgrade immediately.

Question 3

How do I check if my npm package has CVEs?

Accepted Answer

Enter the package name and version on CVE Secure Search, select npm as ecosystem, and click SCAN. The tool checks NVD, OSV.dev and GitHub Security Advisories and returns all matching CVEs with CVSS scores.

Question 4

What is CISA KEV?

Accepted Answer

CISA KEV (Known Exploited Vulnerabilities) is CISA's catalog of CVEs confirmed to be actively exploited in the wild. CVE Secure Search flags all CISA KEV entries so you can prioritise patching.

Question 5

How is CVSS severity calculated?

Accepted Answer

CVSS (Common Vulnerability Scoring System) scores map to severity: CRITICAL (9.0-10.0), HIGH (7.0-8.9), MEDIUM (4.0-6.9), LOW (0.1-3.9). CVE Secure Search calculates severity from the CVSS score when a label is not provided by the data source.