Privacy & Terms

Informational use

ClearCVE provides vulnerability and cybersecurity information for informational and defensive security purposes. It may present or derive information from public and third-party vulnerability and security sources.

Accuracy and decisions

Security information can change quickly. ClearCVE does not guarantee that all information is complete, current or error-free. Verify important remediation and security decisions against authoritative vendor and security advisories.

You are responsible for your security decisions. Do not rely solely on ClearCVE when making critical security decisions.

Acceptable use

Do not deliberately misuse ClearCVE for unlawful activity.

Privacy

ClearCVE has no accounts or sign-in and does not ask for personal information to use the tool. It does not use advertising, cookies or cross-site tracking. It counts how the site is used, as described under “Usage measurement” below.

Browser localStorage and sessionStorage save your theme preference, an interface preference, and CVE batch IDs and results to support navigation between pages and tabs. Pasted advisory text is processed in your browser; only extracted CVE IDs are sent for lookup, and the pasted text is not saved in browser storage.

CVE IDs are sent to ClearCVE’s API, which requests information from third-party security data sources and caches vulnerability responses in server memory. Normal hosting infrastructure may process basic technical request information, such as IP addresses and requested URLs.

Fonts are loaded from Google Fonts, so your browser sends technical request information to Google. If you email ClearCVE, your email address and message are received to respond to your enquiry.

Usage measurement

ClearCVE uses Vercel Web Analytics to count how the site is used, so we can tell which features people need. It does not use third-party cookies, and ClearCVE sets no cookies. Nothing is collected that identifies a person: Vercel recognises a visit by a hash of the request, discards it after 24 hours, and does not tie the data to an individual or an IP address.

What is counted:

• Page views. The page address is sent with everything after the page path removed, so a CVE ID in the address is never sent. Vercel also records the time, the referring site, an approximate location, and the browser, operating system and device type.
• A single CVE lookup.
• A batch lookup, with only its size as a range: 1, 2–5, 6–20 or 21+ CVEs.
• Opening “What do I search for?”, and viewing “What the vendor says to check”.
• Pressing Copy or Copy all on a vendor check, with only the kind of item: command, log entry, file path, file hash, IP address, domain, URL, signature ID or vendor tool.
• Pressing Copy on a starting query, with only its query language: KQL, SPL, ES|QL or LogScale.

Never sent: CVE IDs, pasted text, the values you copy, versions you check, or anything else you type. Each event carries only its name and the range or kind listed above.

For privacy questions, contact info@clearcve.com.