Automatic CVE checker for web applications

How this automatic CVE check works

1. Enter the public URL of a website you own or are authorized to assess.
2. The checker makes one HTTP request and examines response headers plus a limited portion of the returned page for supported technology signatures.
3. If it identifies a version, it checks up to two disclosed versions against matching NVD CPE records and shows any returned CVE details.
4. Review the vendor advisory and your server inventory before deciding whether a finding applies or a fix is needed.

The check recognizes public signatures for PHP, nginx, Apache HTTP Server, OpenSSL, WordPress, Drupal, jQuery and Bootstrap. A product may be present even when no signature is visible; a detected product may also be behind a proxy or belong to a component that is not running on the server.

What an application vulnerability checker can and cannot tell you

A version-to-CVE match is a lead for investigation, not proof that the website is vulnerable. Web servers often hide or alter version headers; front-end libraries can be detected in page markers without proving they are active; and NVD product mappings may not cover every vendor build or backported patch. Confirm the installed package, configuration and vendor security advisory.

This CVE checker does not test authentication, access control, business logic, application source code, installed packages or exploitability. It does not establish that a site is secure when it finds no match. Only use it on public websites you own or have permission to assess.

Recent PHP security advisory

Advisory details checked 22 October 2026. PHP’s security team released fixes on 21 October 2026 for CVE-2026-109618 and CVE-2026-109619. The upstream fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If PHP comes from a Linux distribution or hosting provider, check that vendor’s security update: it may backport fixes without changing to the same upstream version number. ENISA’s joint statement recommends prioritizing internet-facing systems.

This checker only sees versions a site discloses publicly. PHP version headers can be hidden, and a visible version does not prove which runtime or vendor patches are installed. Confirm the result with your hosting provider or server package inventory.

Which CVE checker should I use?

• Use this web application CVE checker when you have a public URL and want to check for supported versions it reveals.
• Use the software version CVE lookup when you already know the product and version you want to check.
• Use the dependency vulnerability checker to review supported package manifests or lockfiles for known dependency advisories.
• Use the free website security scan for a broader set of passive website checks. It is not a substitute for an authorized, in-depth security assessment.

Automatic CVE checker FAQs

Does this checker scan every page of a website?

No. It makes one passive request to the URL you submit and checks the response headers and a limited amount of page content. It does not crawl the site.

Does a CVE result confirm that the website is vulnerable?

No. A matching version fingerprint and NVD record are not proof that the affected component is installed, reachable or unpatched. Check the vendor advisory and the actual server or package inventory.

Why might the checker find no software or CVEs?

The site may hide version information, use unsupported software, or expose no recognizable signature in the response. NVD may also have no exact product-and-version CPE match. A result with no match does not mean the site has no vulnerabilities.

Can I use it as a complete application vulnerability scanner?

No. It is a narrow, passive technology and CVE check. It does not test for exploitable flaws, authenticated issues, access-control problems or vulnerabilities in application code.