# Vulnerability lookup and exposure

> Look up a CVE or GHSA in its public sources and see which of your proxied sites it may affect, from the API, the CLI or MCP.

`GET /v1/vulns/{id}` looks up a CVE or GitHub advisory in cve.org, CISA KEV, FIRST EPSS, GitHub advisories and NVD: state, CVSS, CWE, affected products and versions, KEV dates, EPSS score, aliases and references. An unknown id answers `exists: false`; it is never guessed.

`GET /v1/orgs/{org}/vulns/{id}/exposure` compares it with every proxied site you can see, passively: the site's `stack` setting and a fingerprint of its homepage taken once a day. Each site gets `affected`, `posible` or `no_detectado`, a confidence, the evidence and the state of the edge's mitigation, for example shield 1009 for CVE-2026-111497. Any role can use both.

From the terminal, `openwaf-cloud ctl vulns show` and `ctl vulns exposure`; in MCP, the new read tools `vuln_lookup` and `vuln_exposure`.

See [Does this CVE affect me?](https://developers.openwaf.dev/waf/does-this-cve-affect-me/) and the [API reference](https://developers.openwaf.dev/api/vulnerabilities/).