Technical note
Reading a CVSS vector for the shape that gets exploited at scale
A base score is one number. The vector behind it says whether an issue is reachable over the network, needs no privilege and no user interaction — the combination that gets exploited at scale. The CVE lookup reads the vector.
· 1 min read · written from the shipped implementation
Why the score alone misleads
Two vulnerabilities can share a base score and differ completely in practice. One needs an authenticated user to click something; the other is reachable by anyone on the internet with no credentials and no interaction. The second is what worms and mass-exploitation campaigns are built from. The score does not separate them; the vector does.
AV:N attack vector: network — reachable remotely
PR:N privileges required: none
UI:N user interaction: noneWhat the lookup does
The Vulnerability CVE Lookup searches public vulnerability data by product and version, ranks advisories by base score, and reads each vector to flag the network-reachable, no-privilege, no-interaction shape. That flag is a triage aid: it says which entries to read first, not which to ignore.
What it is explicit about not knowing
A CVE list is not a risk assessment. Exploitation status is not consulted, so a flagged entry may have no known exploit and an unflagged one may be under active attack. And an empty result means nothing matched the query — a mistyped product name, a version string the data does not carry — never that a product is clean. The tool's limitations say all three, because a lookup that let silence imply safety would be worse than no lookup.