Research preview
Exposure Matcher
Check an asset inventory against every vulnerability CISA lists as exploited in the wild. Each result shows the evidence behind it, and anything the data cannot settle is marked as uncertain rather than guessed.
Your inventory never leaves this browser. The file is read and matched on this device. The only network requests are for the tracker’s two public data files. Nothing is uploaded, stored or logged, and closing the tab discards it.
Inventory columns
- asset_id
- Your label for the asset. Optional; use any name, not a real hostname if you prefer.
- vendor
- Product vendor, e.g. Palo Alto Networks.
- product
- Product name, e.g. PAN-OS. Required unless a cpe is given.
- version
- Installed version, e.g. 12.1.4-h11. Without it, findings stay candidates.
- cpe
- Optional CPE 2.3 string; used for identity and version when present.
- internet_exposed
- yes, no or unknown (blank means unknown).
- criticality
- low, medium, high or critical (blank means unspecified).
- environment
- Optional label such as production or lab.
No IP addresses, credentials or real asset names are needed.
How matching works
- Data: affected products and versions come from the official CVE record for each KEV entry, as the vendor or CNA wrote them.
- Identity: vendor and product must match exactly, after a small reviewed alias list (FortiGate is FortiOS, Pulse Connect Secure is Connect Secure), or by CPE. A partial name overlap is reported as insufficient evidence.
- Versions: compared only when both sides are plain version numbers in a recognised scheme, including PAN-OS hotfixes, Ivanti R-releases and Citrix builds. Fixes are applied per maintenance branch. Anything else stays a candidate.
- Coverage: roughly 40% of KEV CVEs carry version data the matcher can compare. Older records without it produce candidates, which you should check against the vendor advisory.
Priority, without a hidden score
Every result here is already known to be exploited. Priority combines how strong the match is with the exposure and criticality you supplied. EPSS is shown and only orders results within a tier.
- P1
- Version in an affected range, and the asset is internet-exposed or critical, or the CVE has known ransomware use.
- P2
- Version in an affected range otherwise; or the product matches on an internet-exposed or critical asset but the version could not be confirmed.
- P3
- Product matches, version not confirmed, asset not exposed or critical.
- P4
- Only a partial name match: insufficient evidence.
A match means the CVE record’s versions include yours. It is not proof of compromise, and no match is not proof of safety: only KEV CVEs are checked. Methodology, privacy and limitations: EXPOSURE-MATCHER.md(opens in a new tab). The same engine runs offline: matcher/cli.ts.