CVE Scanner: Check a Website Against a Specific CVE

Most people arrive here after a CVE hits the news. You don't need the CVE number — you need to know which software you run.

Which one do you run?

Paste a domain and you get one of three answers in a few seconds: potentially affected, not detected, or inconclusive — inconclusive is common if your site sits behind a CDN or WAF, and it is not a failure. One checkbox confirms you are authorized to test the domain; that's the only step.

CVE checker by domain: pick the product you run

You supply the host; the registry supplies the affected range. Not sure which one applies? Start from the product you run, not from the CVE number.

KEV listing means exploitation has been observed in the wild — that's the catalog's inclusion criterion.

CVE-2026-87902 — WordPress core

CVE-2026-71362 — Magento Open Source and Adobe Commerce 2.4.x (alias CVE-2026-75650)

CVE-2026-109618 — PHP (PHP2Shell, alias CVE-2026-109619)

All three entries were last verified 2026-10-22.

What the CVE scanner actually sends

A check sends three or four ordinary GET requests. Your homepage is read twice — once for headers, once for the body — and a few well-known paths are probed on top of that: WordPress adds /readme.html and /feed/, PHP adds its public credits URL /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 (which only answers when expose_php is on), and Magento adds /magento_version and /composer.json. The path list is capped at six entries.

No crawling, no fuzzing, no login forms, no admin-panel guessing. Our user agent says exactly who we are, so you can find the request in your own logs: ScyScanCVEChecker/1.0.

If we can see the product but can't pin a version on it — an X-Powered-By header that just says PHP, say — we report inconclusive instead of guessing the version.

How to read the result — and what "not detected" means

Three answers, and they mean very different things.

  • Potentially affected: the version we read sits inside the published affected range. If the fingerprint matched but the version didn't come through cleanly — a packaged build, or a number cut off mid-way — we flag it rather than stay silent. Treat it as a prompt to patch and verify, not as a final answer.
  • Not detected: either we read a version and it sits outside the affected range, or we read no version at all. Not detected does not mean the site is not affected. If no version string came back, we have no evidence either way: hardened builds strip it, reverse proxies serve static pages, and some applications never publish a version.
  • Inconclusive: we couldn't get a clean look. Usually the site sits behind a CDN or WAF, so the version header belongs to the proxy rather than your origin. Sometimes the request was blocked or timed out; sometimes we saw the product but not a version we could compare. That is not a failed check — it is the useful answer: it tells you to confirm the version on the server itself.

Version numbers are a rough signal in both directions, and this is where most people get it wrong. Distributions routinely backport fixes without changing the version string, so an older-looking version may already carry the patch, while a patched-looking header proves nothing on its own. Confirm against the vendor advisory before you act on a result.

Pick the one you run — WordPress · Magento · PHP — and paste a domain.

CVEs we can't check from the outside

Some CVEs leave no trace in an HTTP response at all. CVE-2026-53266 — an out-of-bounds bug in the Linux kernel — is the clearest example: the kernel version never appears in a web response, so no external probe can see it. We don't ship a checker for it, and a tool that claims to read it remotely is guessing.

Verify it on the host instead:

  • uname -r — for the running kernel release
  • dpkg -l | grep linux-image — for installed kernel packages on Debian and Ubuntu
  • rpm -qa | grep kernel — for installed kernel packages on RHEL-family systems

Compare the output against your distribution's advisory. If the running release is older than the fixed one, schedule the update and reboot.

Other checks worth running

A CVE check covers one product at one version. These cover the rest of the surface.

Looking for a CVE that isn't listed here? The CVE database covers the wider catalogue; this page only carries the checks we can actually run.

Not sure which one? Start with the product you run. If you are still unsure, WordPress is the most common of the three — WordPress · Magento · PHP

FAQ

Does "not detected" mean my site is safe?

No. It means we did not read a version that fell inside the affected range. Version headers can be hidden by a CDN, a WAF, or a proxy, and some applications never expose a version at all. Not detected is the absence of evidence, not evidence of absence.

Does this check attack my site?

No. It's the same handful of GET requests a browser makes. Nothing is exploited, nothing is brute-forced, and we don't touch a login form. Our user agent is ScyScanCVEChecker/1.0, so the request is easy to find in your logs.

Why can I only check one CVE at a time?

Each checker maps one fingerprint to one affected range, so a check has to target a specific product. Running several at once would mean guessing which software is installed, and guessing produces the false negatives this tool exists to avoid.

How current is the data?

Affected ranges come from the registry, last updated 2026-10-22, and every entry shows the date it was last verified. Advisories change. When a range is revised upstream, the entry is updated and its date moves with it.

Can I check a server I don't own?

Only with authorization. The check is read-only and sends no exploit, but pointing it at a host you don't control is unauthorized testing. Get written permission, or ask the owner to run it.

What is a version fingerprint?

The version string a server publishes by default — in a response header, a generator meta tag, or a version endpoint. Most applications leak one unless someone has deliberately removed it. That string is all we read; we never try to make the server reveal anything it isn't already sending.

Sources and verification

由 ScyScan 安全研究团队审阅. Registry last updated 2026-10-22.