How to check a software version for known CVEs
A CVE check compares one product version with NVD, OSV and CISA’s known-exploited list. What a clean result does not mean, and how stack watch turns the same match into an alert.
A CVE checker answers a narrow question: which published advisories include this exact version. It does not scan your server, it does not guess a version from a banner, and a clean result is not a safety certificate. It is the list those sources returned for the name and version you typed.
The version has to be the one you run
Advisories apply to a range, not to a product name. Node.js 20.11.0 and 20.11.1 are different answers. The free checker on this site takes a product and a version, nothing else. A leading “v” is ignored when the rest is a version (v20.11.0 and 20.11.0 match); anything else is kept, so the comparison sees what you typed.
Products we recognise — nginx, Node.js, OpenSSL and the rest of the catalog — are matched against NVD’s CPE version ranges, the same match stack watch uses. A name that is not in the catalog is queried as a package on OSV.dev, which includes the GitHub Advisory Database, across npm, PyPI, Go, Maven, RubyGems, crates.io, NuGet and Packagist. CISA’s Known Exploited Vulnerabilities catalog flags CVEs that are being used in the wild. If a source does not answer, the result says so. We do not fill the gap with invented entries.
curl -fsS https://api.hypermonitors.com/v1/tools/vulnerabilities \
-H 'content-type: application/json' \
-d '{"product":"nginx","version":"1.24.0"}'The body is those two fields. The endpoint is limited to 10 requests a minute per caller, tighter than the other free tools, because a miss asks NVD and OSV. Repeats of a version you already asked about are served from a cache that lasts six hours, so a result can be up to six hours behind a brand-new advisory. At most 80 advisories are returned in the list; the verdict counts the rest.
What “nothing found” is allowed to mean
- Those sources reported no advisory whose range includes this exact version. The next advisory can be published tomorrow.
- A distribution may have backported a fix without changing the version string. A hit — and a clean result — still needs the vendor’s notes before you treat it as the last word.
- A package name that is not in the catalog is only as good as the ecosystems that were queried. A near miss suggests a catalog product instead of guessing. An empty package result can be a typo.
Hearing about the next one
The checker is a one-off, and it needs no account. Stack watch is the continuous version, on Solo and above, and it uses the alert channels you already have. You list the software you run, optionally with the version. Advisories that predate the item are listed and not alerted; only a newly published match is pushed. The default threshold is known-exploited vulnerabilities only. Solo watches up to 3 items and cannot widen that threshold. Team watches up to 100 and can choose a wider threshold. Enterprise has no item cap and can choose the threshold too. The free plan includes none of this.
A whole dependency tree can be uploaded as a lockfile or an SBOM — CycloneDX or SPDX, for npm, pnpm, Yarn, Composer, pip, Go, Bundler or Cargo — and is checked against OSV.dev. The upload counts against the same item cap, so a real lockfile does not fit in Solo’s three slots. HTTP monitors can show the software a site discloses in Server and X-Powered-By, with a way to watch that name. The API lives under /v1/stack. None of that replaces reading the advisory: the checker and the watch both tell you the range matched. They do not patch the host.