Exploitable Vulnerabilities Database
The local database of CVEs with exploitation evidence: check a product version, filter, and read a CVE.
A local database of CVEs that carry real exploitation evidence, searched entirely inside the installation: no external lookup, no data leaving it. Open it with Vuln DB in the sidebar (Library).
Every CVE in it has at least one piece of exploitation evidence; a CVE with nothing behind it but a severity score is not in here. The feed ships with the image and grows with each release. The subtitle under the page title gives the number of CVEs in your build and when the feed was loaded, and the evidence cards give the count of each level.
What counts as evidence
Each CVE has one evidence level, the strongest that applies:
| Evidence | Meaning |
|---|---|
| Exploited in the wild | Listed in a known-exploited catalogue: attackers use it. The strongest signal available. |
| Public exploit | Working exploit code is published. |
| Proof of concept | Proof-of-concept code or a write-up is published, though not necessarily a weaponised exploit. |
| Predicted (EPSS) | No exploit link, but EPSS puts it in the top 10% most likely to be exploited. |
Proof-of-concept code is by far the most common level and known exploitation the rarest, which is why the level matters more than the count. Opening a CVE that is not in the database says it has no exploitation evidence.
Search for a product and version
The main use: a scanner reported a product version, and you want to know which of its CVEs have an exploit.
Type the product and the version in the search box, for example
apache http server 2.4.49, and press Enter. Name the product, not just the vendor.Check: under the search, Searching for shows the product words and the version, with how many CVEs are affected, without a verdict and not affected.
Read the Version column: affected CVEs come first.
Click a CVE for its exploit references and affected versions.
| Version verdict | Meaning |
|---|---|
| Affected | The version is in an affected range. Beside it: fixed in X when a fixed version is known, or version named in the advisory. |
| Not affected | The version is outside every affected range. Hidden by default. |
| No range stated | Neither NVD nor the advisory text states which versions are affected. |
| Branch not listed | The advisory states ranges only for other release branches. |
| Other product | NVD lists only other products for this CVE: it mentions your search without affecting it, or affects a plugin or add-on. |
| Same vendor only | Your search matched only the vendor of the affected products. Add the product name. |
The version is checked against the affected ranges published for the CVE or stated in its description; the CVE page says where a range came from. A range in the description counts only where the description names the product you searched for in full, so type the whole product name as advisories write it. Two notices may appear above the list: one when the search matched only a vendor, suggesting the product name, and one when the search matched more CVEs than were checked against the version, asking you to add a product word or a filter.
This matters when triaging an infrastructure finding: whether the reported CVE has a published exploit is usually the difference between this week and next quarter.
Searching and filtering
The search box takes a CVE, a product and version such as nginx 1.18.0, or a CWE.
| Control | What it does | Default |
|---|---|---|
| Evidence cards and Evidence chips | Narrow the list to one or more evidence levels. | All levels |
| In your findings card | The exploitable CVEs named by open findings in your team's products. Click it to filter. | Off |
| CVSS severity | All severities, Critical, High, Medium, Low or Not scored. | All severities |
| EPSS percentile | Any EPSS, EPSS top 50%, top 10% or top 1%. | Any EPSS |
| Published | Published any time, in the last 30 days, the last 90 days or the last year. | Any time |
| Version verdict | Shown after a product and version search: Affected and no range stated, Affected only, or All, including not affected. | Affected and no range stated |
| Ransomware use | CVEs known to be used in ransomware campaigns. | Off |
| New in the latest feed | What the last feed update added. | Off |
| Only in my findings | CVEs that open findings in your team's products name. A product select then narrows it to one product. | Off |
| Sort | Highest risk, newest, CVSS, EPSS, or recently added to KEV. | Highest risk |
| Clear all filters | The filter icon at the end of the filters resets everything. |
The Your findings column links to the open findings that name a CVE on the Vulnerabilities page. It and the In your findings card are shown to members who may see findings. Export CSV downloads the CVEs the current filters show, up to 20,000 rows.
The CVE page
Click a CVE to open its page: the evidence level, the CVSS score and vector, the EPSS score with its percentile, the KEV dates and ransomware use where they apply, the description and required action, the affected versions, the exploit references grouped by source, and the other references. Buttons link out to NVD and, for known-exploited CVEs, to the CISA KEV catalogue. Back to the list returns to your search.
- Check version grades one version against this CVE. Enter a version with a dot, such as
1.18or8.2p1. - Your exposure lists the findings in your products that name this CVE; Open in Findings opens them on the Vulnerabilities page.
A CVSS label alone is not evidence. The point of this database is the distinction between scored severe and someone has actually exploited this.
Where else ScanSuite uses it
| Feature | How it uses the database |
|---|---|
| Dependency reachability | Dependency findings without exploitation evidence here are not sent for reachability analysis. See Dependency reachability. |
| Scan reports | The Exploit column of the dependency and infrastructure spreadsheets. See Exploits in scan reports. |
| AI Pentest | Uses the database when it researches exploits for a service version. See AI Pentest. |
Last reviewed 2026-10-19