Browse tools

Website Vulnerability (CVE) Check

A vulnerability check for a website you own or look after. Prove you control the site, then it reads the software versions the site reveals, matches them against a database of 223 current, actively-exploited vulnerabilities (CVEs), and tells you plainly what is affected, how serious it is, and how to fix it. You can also tick the products you run (firewalls, webmail, collaboration tools) and enter their versions for things a website doesn't show from outside.

This reads only the home page and public headers, the same as any visitor. It never tries to log in, break in or change anything, and it never stores page content. You can scan only a site you prove you control. Only check sites you own or are authorised to check.

How it works

  1. Prove it's yours. We give you a short token. Put it in a file at /.well-known/osir-site-verify.txt on the site, or add it as a DNS TXT record. Then we check it. (If you're signed in on the owner's network, this step is skipped.)
  2. We read the versions. We look at the home page and headers for the PHP version, the web server, and the CMS (WordPress, Drupal, Joomla) and its version, where the site reveals them.
  3. Add what we can't see. Many products (firewalls, VPNs, webmail, collaboration servers) don't show their version to the public. Tick the ones you run and type the version, and we check those too.
  4. We match and advise. Each version is checked against 223 current critical and actively-exploited CVEs. For every match you get the CVE, how serious it is, the fixed version and how to update.

The database was last refreshed on 2026-10-21. It covers software that can be reached over the web, drawn from the official CVE records and the US CISA Known Exploited Vulnerabilities list. It isn't every CVE in existence — it's the current, high-risk, internet-facing ones — so a clean result means none of these were found, not that the site is free of every possible flaw.

What it won't do

  • It never tries to exploit anything, log in, or send anything to the site beyond reading its public home page.
  • It won't scan a site you haven't verified, so it can't be used to find targets.
  • It shows no exploit detail — only what's affected and how to fix it.

Go deeper