Design language

Calm, factual, traceable

A modern reference UI that security teams and their agents both read. Light by default, dark when the OS asks. Every coloured verdict opens to the vendor's own words.

Evidence first

A verdict always links to the quoted vendor statement. No score without a source.

Claimed is not measured

The basis is always visible. A missing claim is grey, never red.

Shape, word, then colour

Each status has an icon and a label, so it reads in greyscale and for colour-blind readers.

One action per view

The primary button is ink. Yellow is the brand mark and the focus ring, never data.

One typeface

Manrope for everything. Monospace only for CVE ids, rule ids and code.

Machine twin

Every page has JSON and Markdown alternates, and the same answers over MCP.

Surfaces and ink

Light shown; dark has its own tuned values

--bg
Page

--surface
Cards

--surface-2
Hover, quotes, code

--line
Borders

--ink
Text, primary action

--ink-2
Body copy

--ink-3
Meta and labels

--brand
Brand mark, focus ring

Status colours

Reserved for coverage meaning, always with icon and label

--ok
Blocks by default · covered

--warn
Logs only · partial

--serious
Off by default

--info
Rule, action unknown · charts

--crit
Exploited · exposed

BlocksLogsOffRuleNo public claimBefore feed historyNo public source+Nd: first rule N days after the CVE was published

Type

Is it blocked at the edge yet?

Section heading · Manrope 700

Lede · Manrope 400 at 18px. Sentences explain; they don't decorate.

Meta · 13px · CVE-2026-109618 in monospace

Coverage row

One CVE, one badge per vendor

Vulnerability	Exploited	CVSS	CloudflareCF	AWSAWS	AzureAzure	GoogleGoogle	FastlyFastly	F5F5	AkamaiAkam.	CRSCRS
PHP Memory Corruption Vulnerability CVE-2026-109618	2026-10-26	9.2	Blocks+0d	Rule+0d			Rule+0d	Rule+1d

Site check result

Covered, partial, cannot confirm, exposed

Rule blocks by default

shop.example.com is behind Cloudflare. Cloudflare ships a rule for CVE-2026-109618 that blocks by default since 2026-10-21.

It only protects you if that managed ruleset is enabled for your site. Check that it is deployed and not overridden.

shop.example.comEdge: CloudflareBlocks by default

Run a free Cloudflare Checkup See the vendor's statement

How we know1 DNS fact

Network AS13335 CLOUDFLARENET - Cloudflare, Inc., US

From public DNS only; we never contacted shop.example.com. A WAF on your own load balancer is invisible to DNS.

Controls

Primary Secondary SmallExploited in the wildBlocks+0dNeutral

$ curl https://cve.vigilbase.com/api/v1/cves/CVE-2021-44228