CVE Stack Analyzer

How it works

• The data comes from NVD, not from a scan of your systems.

  Every query goes to the National Vulnerability Database run by NIST, the public reference catalogue for disclosed vulnerabilities. Nothing on this page connects to your network, reads your configuration or asks for credentials. You pick products from a list and the tool asks NVD what has been published about them.

• The window is the last ninety days.

  The results deliberately cover a recent window rather than the whole history of a product. A list of everything ever published for Windows Server is not information, it is noise. Ninety days answers a different and more useful question: what has changed lately that I might have missed.

• Your address never reaches NVD.

  The request is proxied server-side, so NIST sees the site and not you. Responses are cached briefly so that the same lookup does not hit the upstream API twice, which also keeps the tool responsive when several people use it at once.

• Severity is CVSS v3.1, as published.

  Each entry carries the base score assigned by the publishing authority, mapped to the usual four bands. That score describes the vulnerability in the abstract, not in your environment: the same CVE can be urgent on an internet-facing box and irrelevant on an isolated segment.

Read this before you act on the output

This is an indicator, and the difference between an indicator and an inventory is the difference between a hint and a decision.

• The match is by keyword, not by CPE and version. Selecting a product looks for its name in the published records. It does not know which version you run, so it will show entries that do not affect you and can miss entries filed under a different product name.
• No result does not mean no exposure. An empty list means nothing matching that keyword was published in the window. It says nothing about older vulnerabilities, unpatched systems or anything the vendor has not disclosed.
• Severity is not priority. Ranking work by CVSS alone is one of the most common ways a vulnerability programme wastes its effort. Exposure, reachability and compensating controls decide what gets fixed first.
• It is not a substitute for a scanner. Proper vulnerability management needs an authenticated tool with an asset inventory — Qualys, Nessus or equivalent. This tool tells you where to look; it does not tell you what you have.

Common questions

How current is the data

It is read live from NVD each time you run an analysis, with brief caching. NVD itself takes time to enrich a record after disclosure, so a very recent CVE may appear without a score yet.

Why is my product not in the list

The selector covers common enterprise products across endpoint, SIEM, network, cloud, identity and operating systems. It is a starting set, not the NVD catalogue, which runs to thousands of entries.

Do you record what I select

No. The selection lives in the page and is not stored or associated with you. Only the product keyword travels to the proxy, never anything identifying.

Can I use it for an audit

Not as evidence. An assessor will ask for output from an authenticated scanner tied to an asset inventory. This is useful earlier than that: to see whether a stack deserves a closer look at all.

What should I do with a critical result

Check whether the version you run is actually affected, whether the component is reachable from outside, and whether the vendor has published a fix. If those three answers are unclear, that is precisely the point at which a conversation is worth more than another tool.