WappaCVElyze by cw

WappaCVElyze identifies the web technologies behind the page you are on — server software, CMS, frameworks, JavaScript libraries — and, unlike a plain technology detector, shows the detected version and whether that version is safe.

Each technology gets a verdict:
• Current — newest release of a maintained cycle, no known CVE
• Outdated — no known CVE, but a newer release exists
• End of life — the release cycle no longer receives fixes
• Vulnerable — a CVE applies to this exact version, with the affected range, CVSS, EPSS exploitation probability and public-exploit flags
• Critical — the CVE is on CISA's Known Exploited Vulnerabilities catalog

Every red row links to the NVD record, the CISA entry and the vendor advisory that confirm it.

Verdicts come from a small database built daily from public sources (NVD, CISA KEV, FIRST EPSS, endoflife.date, Retire.js, Nuclei and Metasploit exploit indexes) and downloaded once a day. Page content is analysed locally and never leaves your browser; the site you visit is never sent anywhere. Privacy policy for every request the extension makes: https://github.com/xZoroo/wappacvelyze/blob/main/PRIVACY.md.

Open source (MIT): https://github.com/xZoroo/wappacvelyze — a command-line scanner with the same verdicts is included.