Would like to ask currently, is the National Vulnerability Database (NVD) still the place to go if you want to search for update vulnerabilities for different products? I find that some product vulnerabilities are not found in the NVD database. For example, I search for "Sitefinity" and it gives me no results. But when I do a search on Google, I found something on osdir. Is there another alternative vulnerability database that you know of that is more updated?

closed as primarily opinion-based by TildalWave, Ayrx, Xander, Rоry McCune, Scott Pack Jul 14 '15 at 19:04

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.


NVD is an authoritative source for vulnerabilities reported to them. They do not list vulnerabilities that merely exist in the wild.

So, yes, the NVD is a fine place to go, but it is never going to be fully complete. Not every vulnerability is issued a CVE.

  • ok, so the only other way is to use the search engine. thanks – Pang Ser Lark Jul 14 '15 at 4:04

There are quite a lot of vulnerability DBs out there.

In the good old days, those were Milw0rm and 0day.

Now you probably look at http://www.rapid7.com/db/
as well as https://www.exploit-db.com/

Not the answer you're looking for? Browse other questions tagged or ask your own question.