Data brain
Security Certifications Explorer
Every FIPS 140-3 and FIPS 140-2 cryptographic module validation from the NIST CMVP, every Common Criteria certificate and every certificate of the new EU scheme, EUCC, in one place: vendor and product, security level or EAL, status, validity and sunset dates, the evaluation lab, the algorithms a module implements with their CAVP certificates (including post-quantum ones such as ML-KEM and ML-DSA), the certificates it builds on, and the CVEs that may affect it.
The data comes from sec-certs.org, built by the CRoCS lab at Masaryk University from NIST CMVP, the Common Criteria Portal and ENISA. KBrain syncs it weekly. Search it here, or ask it from Claude, ChatGPT, or any MCP assistant, with no setup.
5,558 FIPS 140-3 / 140-2 certificates - 6,855 Common Criteria certificates - 112 EUCC certificates - synced November 3, 2026
Products in certificationProtection profiles
Check a certificate and its CVEs
- Search a product, vendor or certificate number below and open the certificate: status, level or EAL, validity and sunset dates, lab and algorithms.
- Open each related CVE to see its CVSS severity, CISA KEV status and EPSS score on the CVE Explorer.
- Read the CVE before acting: related CVEs are automated matches on product and platform names, so they mean "check this", not "the module is broken".
To do all three in one question from Claude or ChatGPT, follow the setup guide with a worked example.
Certified products that may be affected by CVE-2014-0001
- Red Hat Enterprise Linux 5 OpenSSH-Server Cryptographic Modulehistorical498 related CVEsRed Hat®, Inc. - FIPS 140 #1384 - FIPS 140-2 - Level 1 - certified August 12, 2010
- Red Hat Enterprise Linux 5 OpenSSH Client Cryptographic Modulehistorical194 related CVEsRed Hat®, Inc. - FIPS 140 #1385 - FIPS 140-2 - Level 1 - certified August 12, 2010
- Red Hat Enterprise Linux 5 OpenSwan Cryptographic Modulehistorical194 related CVEsRed Hat®, Inc. - FIPS 140 #1386 - FIPS 140-2 - Level 1 - certified August 12, 2010
- Red Hat Enterprise Linux 5 Kernel Crypto API Cryptographic Modulehistorical194 related CVEsRed Hat®, Inc. - FIPS 140 #1387 - FIPS 140-2 - Level 1 - certified August 12, 2010
- Red Hat Enterprise Linux 5 OpenSSL Cryptographic Modulehistorical194 related CVEsRed Hat®, Inc. - FIPS 140 #1320 - FIPS 140-2 - Level 1 - certified June 9, 2010
- Red Hat Enterprise Linux 5 Libgcrypt Cryptographic Modulehistorical194 related CVEsRed Hat®, Inc. - FIPS 140 #1305 - FIPS 140-2 - Level 1 - certified April 26, 2010
Source: sec-certs.org (CRoCS, Masaryk University), from NIST CMVP, the Common Criteria Portal and ENISA (EUCC). Related CVEs are automated matches by sec-certs and may be incomplete or wrong.
Guides and use cases
- Which certified products are affected by a CVE? FIPS 140-3 and Common Criteria exposure with AI
A certificate says a product passed an evaluation, not that it is free of vulnerabilities. This use case shows how to find the certified products a CVE may affect, and the CVEs that may affect a certified product, inside Claude or ChatGPT.
- Check FIPS 140-3 and Common Criteria status before you buy, from your AI assistant
Procurement questionnaires ask for FIPS 140-3 and Common Criteria proof. This use case shows how to verify a vendor claim in seconds, including status, level, validity dates and sunset, from Claude or ChatGPT.
- Find post-quantum FIPS 140-3 validated modules
Post-quantum migration starts with knowing what is already validated. This guide shows how to search the Cryptographic Module Validation Program list for modules with ML-KEM and other post-quantum algorithms, with a worked example.
- Verify FIPS 140-3 pending, MIP and evaluation claims
"FIPS 140-3 pending" can mean anything from "we signed with a lab" to "NIST is finalising the certificate". This guide shows where a product really is, with the CMVP queue statuses, a verification checklist and the warning signs in marketing claims.
- How to check a FIPS 140-3 or Common Criteria certificate and its CVEs in Claude or ChatGPT
The setup guide for the Security Certifications brain: connect it to Claude or ChatGPT, look up a certificate, then check its related CVEs in the same chat.
- FIPS 140-3 vs Common Criteria: security levels, EALs and what each certification proves
FIPS 140-3 and Common Criteria are the two certifications security buyers ask for most. This guide compares what each one covers, how FIPS 140-3 security levels and Common Criteria EALs work, and what neither of them proves.
- What is the CMVP? How FIPS 140-3 validation works, from CAVP to certificate
Every FIPS 140-3 certificate comes out of the CMVP. This guide explains who runs it, how a module goes from algorithm testing to a certificate, what the four security levels require, and what active, historical and revoked mean.
- Common Criteria EAL levels explained: EAL1 to EAL7, augmentations and protection profiles
An EAL tells you how deeply a product's security claims were evaluated, not how strong they are. This guide walks through the seven levels, augmentations such as ALC_FLR and AVA_VAN.5, protection profiles and the national schemes that issue certificates.
- What is EUCC? The EU Common Criteria cybersecurity certification scheme explained
EUCC replaces national Common Criteria certification inside the EU with one scheme and one certificate recognised in every member state. This guide explains how it works and how to search EUCC certificates next to FIPS 140-3 and Common Criteria ones.
- Security certifications MCP server: FIPS 140-3 and Common Criteria data for AI agents
Security agents need certification data as tools, not as PDFs. KBrain hosts an MCP server for FIPS 140-3 and Common Criteria certificates, joined with the CVE brain, so any MCP compatible assistant or agent can query it.