Reference · Advisory Database

A CVE id means nothing.
This translates it.

A name like "CVE-2024-3094" tells you almost nothing on its own. The Moolé Vulnerability Database is a free, public place to look one up and get a plain answer. What is the flaw, how bad is it, is anyone actually attacking it right now, and how do you fix it. The same intelligence that powers the platform, open for anyone to search.

01 · Look anything up

Type a CVE. Get a straight answer.

You paste in the id from an alert or a news headline. The database gives you back the flaw in one sentence, how severe it is, whether attackers are using it in the wild, which packages and versions are affected, and the exact version that fixes it. Here is a real one, Log4Shell, the flaw that made half the internet patch overnight in December 2021.

advisory.moole.ai · vulnerability database live lookup
CVE-2021-44228 Log4Shell Critical · CVSS 10.0

A remote attacker can run their own code on your server by sending a crafted string that Apache Log4j logs. Log4j sees a special ${jndi:...} pattern in the text it is logging, follows it out to an attacker-controlled server over JNDI, and loads whatever it is told to. Anything that logged untrusted input was exposed.

Exploited in the wild
Actively exploited
Mass scanning and real attacks began within days of disclosure. On CISA's Known Exploited Vulnerabilities list.
Type of flaw
Remote code execution via JNDI lookup injection in the logging library.
Affected package & versions
org.apache.logging.log4j : log4j-core
2.0-beta9 through 2.14.1
The fix
Upgrade log4j-core to 2.17.1 or later. (2.15.0 and 2.16.0 fixed the main flaw but had follow-up issues, so go to 2.17.1+.)

A CVE id is a barcode.
This is the label you can actually read.

02 · Inside an entry

Four things, on every entry.

A raw CVE record is written for tooling, not people. Every entry here answers the questions you actually have, in the order you have them.

01

Plain description

What the flaw actually is, in one sentence a person can read, instead of a paragraph of standards language.

The bug, explained like you would explain it to a teammate.
02

Real-world exploit context

Whether attackers are using this right now, not just a theoretical score. A flaw on active exploit lists is a different kind of urgent.

Is this being used against people today, or only on paper.
03

Metrics done right

Severity paired with exploitability, so you can tell a scary-sounding flaw nobody can reach from the one you should drop everything for.

How bad, and how likely, side by side.
04

The fix

The specific safe version to upgrade to, or the mitigation to apply. No hunting through release notes to find the number.

The exact version that closes it.
03 · The Zero Day Dictionary

Security terms, in plain English.

Alongside the CVEs, the database includes a glossary Moolé calls the Zero Day Dictionary. Around 100 security terms, each defined in one clear sentence, so when a report says "SSRF" or "SBOM" you do not have to go looking. A few examples.

SSRF · Server-Side Request Forgery
A flaw where an attacker tricks your server into making requests to places it should not, like internal systems that are not exposed to the outside.
IDOR · Insecure Direct Object Reference
When changing an id in a request lets you read or edit someone else's data, because the app trusts the id without checking you are allowed to touch it.
Supply-chain attack
An attack that reaches you through software you trust, by compromising a dependency, a build tool, or an update instead of hitting you directly.
SBOM · Software Bill of Materials
A complete list of every component and dependency inside a piece of software, so you know exactly what is in it and can check it against known flaws.
04 · Same brain as the platform

Not a separate silo.

The database is the reference face of the same intelligence Moolé uses inside the platform. When Moolé ranks real risk across your code, your dependencies, and your containers, this is the knowledge it is drawing on. Look something up here, and you are seeing the same source that decides what makes your short list.

Open the vulnerability database →