Where can I look up a CVE for free?
The CVE Program record at cve.org carries the description and affected versions, NVD adds enrichment where it is prioritised, CISA KEV confirms exploitation, and the vendor advisory is the only authority on the fix. For open-source packages use OSV.dev or GitHub Security Advisories, and FIRST publishes EPSS probabilities free.
No single source closes a lookup, because the record is split across them by design. Identity and description sit with the CNA at cve.org, confirmed exploitation with CISA, the fixed version with the vendor, precise version ranges with OSV, and likelihood with FIRST. A triage decision made from one tab is a decision made on partial data.
NVD stopped being the default single lookup in April 2026, when NIST began prioritising enrichment rather than processing everything. cve.org is the one to reach for when NVD is blank: it carries what the assigning CNA published, plus CISA’s Vulnrichment container where that exists, though depth varies sharply between CNAs.
For open source specifically, OSV.dev gives machine-readable affected version ranges across npm, PyPI, Go, Maven and distro feeds, with a free API and no registration. GitHub Security Advisories covers the same ground in the same schema and drives Dependabot. Neither says anything about appliances, firmware or commercial software, which is where vendor advisories remain the only option.
This site sits in that list rather than above it. It holds more than 16,000 analysed CVEs as of September 2026, every one readable without an account, with EPSS and severity attached so unscored records stay triageable. It carries 134 of the 1,695 entries in CISA’s catalog, so when the question is specifically whether something is confirmed exploited, go to CISA directly.