> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/medisao/search-for-a-products-vulnerabilities.md).

# Search for a product's vulnerabilities

**Product Search** starts from what's in your device rather than from a CVE. Look up a vendor, a product, or a specific package version and see every CVE recorded against it. This is useful when you're checking a third-party component before you ship it, or when you're answering "are we exposed?" for a supplier.

## Before you begin

* Your organization's plan must include MedISAO.
* Know at least part of the vendor, product, or package name. For package versions, it also helps to know the ecosystem, such as NPM or PyPI.

## Search for a vendor, product, or version

1. In the sidebar, select **Product Search**.
2. Type at least two characters into the search box (**Search by vendor, product, or version (min 2 chars)**). Results update as you type, so you don't need to press Enter.
3. To narrow the results, change **All** to **Vendors**, **Products**, or **Versions**.
4. If you're looking for a package version, choose an ecosystem from **Any ecosystem**: **NPM**, **PyPI**, **Maven**, **Go**, **NuGet**, or **Cargo**. The ecosystem filter appears only when the result type is **All** or **Versions**.

Results are grouped under **Vendors**, **Products**, and **Versions**, with a count for each group:

| Group        | Each row shows                                                |
| ------------ | ------------------------------------------------------------- |
| **Vendors**  | The vendor name and how many CVEs are recorded against it.    |
| **Products** | *vendor / product* and how many CVEs are recorded against it. |
| **Versions** | *package @ version* and the package's ecosystem.              |

If nothing matches, you see **No matches**. Try a shorter or different query, or remove the ecosystem filter.

## Review the CVEs for a result

1. Select a vendor, product, or version row. A panel opens with the title **CVEs —** followed by what you selected, and the total number of CVEs.
2. Narrow the list if you need to:
   * **Severity:** Choose one or more of **Critical**, **High**, **Medium**, and **Low**.
   * **Min CVSS** and **Max CVSS:** Limit the list to a range of CVSS scores between 0 and 10. CVSS (Common Vulnerability Scoring System) is the standard scale for vulnerability severity.
3. Review the table. It has **CVE ID**, **Severity**, **Description**, and **Updated** columns, and pages through the results 25 at a time.
4. Select a **CVE ID** to open that CVE's detail page, which has its full CVSS metrics, AI-generated update and mitigation guidance, affected products, and references.

If the filters exclude everything, the table shows **No CVEs match these filters.**

## Tips

* **Use Versions for open-source components.** Package-version results are tied to an ecosystem, so they're the most precise way to check a specific library version from your SBOM (software bill of materials, the list of components in your software).
* **Start broad, then filter.** Open a vendor or product first, then use **Severity** and **Min CVSS** to focus on what needs attention now.

## Next steps

* [Search CVEs and check impact on your devices](/medisao/search-cves-and-check-impact.md): read a CVE's detail page and ask Ask MSI about it.
* [Follow security advisories](/medisao/follow-security-advisories.md): see curated advisories that may cover the same products.