Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there a database of vulnerabilities somewhere, that can be queried in such a way as to return results for all non-patched vulnerabilities for a specific piece of software?

For example, I would like to see a list of the current non-patched (workarounds don't count as patches) vulnerabilities, including CVE numbers, in Windows 7.

share|improve this question
@Paul - Having a CVE number does not, by definition, mean it is solved. A fully-patched Windows box will still have numerous vulnerabilities, all with CVE numbers, that do not yet have patches released. The only thing a CVE number represents is that it is a known vulnerability in the Common Vulnerabilities & Exposures list. – Iszi Mar 24 '11 at 20:22
@Paul - For example, CVE-2008-4609 is a vulnerability in the TCP/IP stack affecting almost all Windows OS's since Win2K. Microsoft rates it "Critical" or "Important" for most versions. McAfee Vulnerability Manager marks it as a "Medium" finding. US-CERT rates it "High". However, Microsoft has not (and will not - see Security Bulletin MS09-048) released any patches to mitigate this in XP or 2K. This may be a somewhat-poor example of what I'm looking for (I'm more aiming at zero-day vulnerabilities) but it's one I encounter often. – Iszi Mar 24 '11 at 21:02
If it is registered as a CVE, it can't really be considered a zero-day anymore, can it? – AviD Mar 24 '11 at 22:55
@Avid - Okay, you caught me there. But I'm sure you caught my meaning, too. I was running out of characters again. – Iszi Mar 25 '11 at 0:09
you are right, Avid's answer is the correct reply that I should have provided. Nevertheless, I am aware of software companies that does always provide solutions for vulnerabilities known publicly (and have CVE entries), and that mislead my answer. In between, for many software vendors, a work around is a solution at least on the short run. In General If responsible disclosure is respected (which is the case of Secunia) then this means it is un-patched either because the vendor was not quick enough to patch it but will or the vendor estimates the cost is higher than the risk. – Phoenician-Eagle Mar 25 '11 at 2:46
up vote 6 down vote accepted

On the National Vulnerability Database (NVD) advanced search page, you can search by vendor, product name, and version.

It will find matching CVEs, if the CVE writer was thoughtful enough to include the product information in CPE format.


Since I originally posted this, my company has created a free mirror of the NVD that is much faster and easier to use called SCAP Sync:

share|improve this answer

one good starting point for this would be You can get a list by product there, of known security issues, and the note on the page unpatched issues. For windows 7 for example, there's this list

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.