Free Tool
CVE Decoder
A CVE ID looks like a random code — CVE-2024-12345 — but it is a structured label: a year, a number, and a record kept by a named organisation. Paste an ID below and this decoder checks its format, explains what each part means, and gives you the three official pages where you can read the real record. It never fetches anything itself: the links are yours to open.
Outbound links only — no live lookup. This decoder validates the ID format and explains it. It does not fetch data from any database, and it never sends the ID anywhere. Open the official links below to read the real record.
What this tool does
CVE — Common Vulnerabilities and Exposures — is the public naming system for security vulnerabilities. When a vulnerability is found and reported, it is given a CVE ID, a short label that the whole security world can use to refer to the same flaw. Without that shared label, one team's report of a vulnerability and another team's patch for it would be impossible to match up. The ID is the link between the discovery, the description, the severity score and the fix.
The ID has a simple structure. CVE is the prefix. The first group of digits is the year the ID was assigned — which is not necessarily the year the vulnerability was found, because IDs are often reserved before the details are published. The second group is the sequence number, assigned in order as IDs are issued for that year. Together they form a reference to a record, and the record is where the details live: a description of the flaw, which products and versions it affects, who assigned the ID (the CNA, or CVE Numbering Authority), and links to the advisory and the patch.
This decoder teaches you to read the ID and to find the record. It checks the format — CVE, four digits, a hyphen, at least four digits — and it explains the year, the number and the CNA. Then it gives you the three official places to check the record: CVE.org, the programme's own site; the National Vulnerability Database (NVD), which adds severity scores and product details; and CISA's Known Exploited Vulnerabilities catalogue (KEV), which lists the vulnerabilities known to be exploited in the wild — the list that decides what to patch first. The CVE guide on this site joins those three into one beginner explainer: CVE to score to KEV to patching priority.
Try it
Paste a CVE ID to check its format and get the official links. Example: CVE-2024-12345.
Waiting. Paste a CVE ID and press Decode this CVE ID.
Official sources: the links below appear after a valid ID is decoded. CVE.org holds the record, the NVD adds severity scores, and CISA KEV lists vulnerabilities known to be exploited.
How it works
The decoder works in two steps. First it validates the format against a pattern: the letters CVE, a hyphen, four digits for the year, another hyphen, and at least four digits for the sequence number. That pattern is the only thing the decoder checks — it does not and cannot tell you whether a given ID exists, because it never contacts a database. A well-formed ID that was never issued will pass the format check and lead nowhere on the official sites, and the decoder says so plainly.
Second, it explains the parts. The year is the year the ID was assigned, not necessarily the year of the vulnerability. The number is the sequence within that year, and it says nothing about severity — CVE-2024-00001 is not more dangerous than CVE-2024-90000, it was simply assigned earlier. The full record, which lives on CVE.org and the NVD, adds the description, the affected products, the severity score (CVSS), and the links to the advisory and the patch. And the KEV catalogue adds the operational fact that matters most: whether the vulnerability is known to be exploited in the wild, which is what decides whether to patch it first.
The links the decoder builds are plain web addresses on the official sites, constructed from the ID you typed and opened by you. The decoder itself makes no network requests: you can verify that on the Network tab of your browser's developer tools. That design is deliberate — the site's no-cost rule and its no-third-party-fetch rule both mean the tool must not fetch a live database, and the honest version of the tool is one that teaches you where to look rather than pretending to look for you.
Limitations
This decoder validates a format; it does not look anything up. It cannot tell you whether an ID exists, what the vulnerability is, how severe it is, or whether it is being exploited — those answers live on the official sites it links to, and only there. A well-formed ID is not a real ID, and a real ID is not necessarily a dangerous one: most CVEs are low severity, and severity is decided by the score and the context, not by the number.
- The decoder never fetches data. It constructs links for you to open; the checking happens on the official sites, not on this page.
- The year in the ID is the year of assignment, not the year the vulnerability was discovered or published.
- The sequence number says nothing about severity. Never judge a vulnerability by its number.
Examples
Example 1 — CVE-2024-12345. The format is valid: CVE, the year 2024, and a five-digit sequence number. The decoder explains the parts and gives you the three links: the CVE.org record, the NVD entry with its severity score, and a search of the CISA KEV catalogue to see whether it is known to be exploited. The ID itself tells you nothing about the flaw — the record does.
Example 2 — cve-2024-123. The format is invalid: the sequence number has only three digits, and IDs require at least four. The decoder reports the problem and explains the pattern. Lower-case letters are accepted and normalised, because the meaning is the same — but the digit count is not negotiable.
Example 3 — CVE-1999-0001. A valid format from the first year of the programme. The decoder handles it the same way, because the format has not changed in twenty-five years: a year, a number, and a record on the official sites. Old CVEs are still referenced, still scored, and still patched when they matter.
Frequently asked questions
What is a CVE ID?
A public label for a security vulnerability, in the form CVE-YEAR-NUMBER. It lets the whole security world refer to the same flaw — the discovery, the description, the severity score and the fix — with a single reference.
What do the year and number in a CVE ID mean?
The year is when the ID was assigned, not necessarily when the vulnerability was found. The number is the sequence within that year. Neither says anything about severity — a low number is not more dangerous than a high one.
What is a CNA?
A CVE Numbering Authority — an organisation authorised to assign CVE IDs, usually a vendor or a research group. The CNA is named in the record, and it is the source of the description.
What is the CISA KEV catalogue?
CISA's Known Exploited Vulnerabilities list: vulnerabilities that are known to be exploited in the wild. It is the list that decides patching priority — a vulnerability in KEV outranks one that is not, whatever its score.
Does this decoder look up the vulnerability?
No. It validates the format, explains the parts, and gives you the official links to open. It never fetches a database and never sends the ID anywhere. The checking happens on CVE.org, the NVD and CISA KEV — open the links and read the record there.