Enter a product and the version you run. The result is the known vulnerabilities that affect that exact version: CVE or GHSA id, severity, a short summary, and the version that fixes it when one is published.
Which vulnerability databases does this check?
Products we recognise — nginx, Node.js, OpenSSL and the rest of the stack-watch catalog — are matched against NVD's CPE version ranges. Anything else is queried as a package on OSV.dev, which includes the GitHub Advisory Database, across npm, PyPI, Go, Maven, RubyGems, crates.io, NuGet and Packagist. CISA's Known Exploited Vulnerabilities catalog flags CVEs that are being used in the wild. We do not invent entries, and a clean result only covers the sources that answered.
Why does it ask for an exact version?
An advisory almost always affects a range, not a whole product. Node.js 20.11.0 and 20.11.1 are not the same answer. The version is compared with the published range; if it falls outside, the advisory is not listed.
It says nothing was found. Does that mean I am safe?
It means those sources reported no advisory for this exact version. A distribution may have patched the issue without changing the version string, or the next advisory may be published tomorrow. Results are cached for up to six hours so we don't hammer the upstream databases. Stack watch is the continuous version of this check.
My product is not in the list. What happens?
We still ask OSV about it as a package. If the name is close to a product we know, we suggest that instead of guessing. An empty package result means none of the ecosystems we queried reported an advisory for that name and version — the name may be misspelled, or it may be clean.