> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/medcrypt-documentation/medisao/search-for-a-products-vulnerabilities.md).

# Search for a product's vulnerabilities

**Product Search** starts from what's in your device rather than from a CVE. Look up a vendor, a product, or a specific package version and see every CVE recorded against it. This is useful when you're checking a third-party component before you ship it, or when you're answering "are we exposed?" for a supplier.

## Before you begin

* Your organization's plan must include MedISAO.
* Know at least part of the vendor, product, or package name. For package versions, it also helps to know the ecosystem, such as NPM or PyPI.

## Search for a vendor, product, or version

1. In the sidebar, select **Product Search**.
2. Type at least two characters into the search box (**Search by vendor, product, or version (min 2 chars)**). Results update as you type, so you don't need to press Enter.
3. To narrow the results, change **All** to **Vendors**, **Products**, or **Versions**.
4. If you're looking for a package version, choose an ecosystem from **Any ecosystem**: **NPM**, **PyPI**, **Maven**, **Go**, **NuGet**, or **Cargo**. The ecosystem filter appears only when the result type is **All** or **Versions**.

Results are grouped under **Vendors**, **Products**, and **Versions**, with a count for each group:

| Group        | Each row shows                                                |
| ------------ | ------------------------------------------------------------- |
| **Vendors**  | The vendor name and how many CVEs are recorded against it.    |
| **Products** | *vendor / product* and how many CVEs are recorded against it. |
| **Versions** | *package @ version* and the package's ecosystem.              |

If nothing matches, you see **No matches**. Try a shorter or different query, or remove the ecosystem filter.

## Review the CVEs for a result

1. Select a vendor, product, or version row. A panel opens with the title **CVEs —** followed by what you selected, and the total number of CVEs.
2. Narrow the list if you need to:
   * **Severity:** Choose one or more of **Critical**, **High**, **Medium**, and **Low**.
   * **Min CVSS** and **Max CVSS:** Limit the list to a range of CVSS scores between 0 and 10. CVSS (Common Vulnerability Scoring System) is the standard scale for vulnerability severity.
3. Review the table. It has **CVE ID**, **Severity**, **Description**, and **Updated** columns, and pages through the results 25 at a time.
4. Select a **CVE ID** to open that CVE's detail page, which has its full CVSS metrics, AI-generated update and mitigation guidance, affected products, and references.

If the filters exclude everything, the table shows **No CVEs match these filters.**

## Tips

* **Use Versions for open-source components.** Package-version results are tied to an ecosystem, so they're the most precise way to check a specific library version from your SBOM (software bill of materials, the list of components in your software).
* **Start broad, then filter.** Open a vendor or product first, then use **Severity** and **Min CVSS** to focus on what needs attention now.

## Next steps

* [Search CVEs and check impact on your devices](/medcrypt-documentation/medisao/search-cves-and-check-impact.md): read a CVE's detail page and ask Ask MSI about it.
* [Follow security advisories](/medcrypt-documentation/medisao/follow-security-advisories.md): see curated advisories that may cover the same products.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.medcrypt.com/medcrypt-documentation/medisao/search-for-a-products-vulnerabilities.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.