← All Tools

CVE / CPE Search Builder

Compose a proper CPE 2.3 name from vendor / product / version fields, validate the result, and jump to NVD, MITRE, GitHub Advisory, OSV, or Vulners with one click.

100% client-side. Inputs stay in your browser until you click one of the external search links. No telemetry, no logging.

CPE 2.3 fields

part

vendor

product

version

update

edition

language

sw_edition

target_sw

target_hw

other

CPE 2.3 formatted string

cpe:2.3:a:*:*:*:*:*:*:*:*:*:*

CPE 2.2 URI form

cpe:/a

Paste a CPE to parse

Paste a cpe:2.3:… or cpe:/… name to load it into the fields above.

Search by direct keyword

If no exact CPE exists yet, search by vendor / product keyword instead.

CVE / version pivot

Look up a single CVE or pivot from a version of interest.

CVE ID

Open in

Field encoding rules

Values are lowercase ASCII; spaces become underscores. An empty field or * means ANY; - means NA (not applicable) — NISTIR 7695 §5.3.
In the formatted string (cpe:2.3:…, §6) every punctuation character except period, hyphen and underscore is backslash-escaped: ! " # $ % & ' ( ) * + , / : ; < = > ? @ [ \ ] ^ ` { | } ~. This tool escapes them for you.
* and ? are wildcards (e.g. version 2.4.*); §6.2.3.2 allows them only at the start or end of a value, and the validator flags any other placement.
In the URI form (cpe:/…, §5) the same characters are percent-encoded instead (+ → %2b), the wildcards bind to %02/%01, and the last four attributes pack into edition after a leading ~.
Watch out for vendors with surprising names: Microsoft Office is cpe:2.3:a:microsoft:office:…; Oracle Java SE is cpe:2.3:a:oracle:jdk:…. Always confirm vendor/product against the NVD CPE dictionary.