Which certified products are affected by a CVE? FIPS 140-3 and Common Criteria exposure with AI
Ask your AI assistant which FIPS 140-3 validated modules and Common Criteria certified products may be affected by a CVE, with NVD severity, CISA KEV and EPSS on the same answer. Data from sec-certs.org.
Add the Security Certifications brain to your AI assistant
Regulated buyers often choose a product because it holds a FIPS 140-3 validation or a Common Criteria certificate. That certificate describes the version that was evaluated, on the date it was evaluated. Vulnerabilities keep being published afterwards. When a major CVE lands, security and compliance teams need two answers quickly: which of our certified products may be affected, and is that CVE being exploited. The Security Certifications brain answers both from one question, because it links certificates to the CVE brain.
How certificates and CVEs are linked
The sec-certs project, run by the CRoCS lab at Masaryk University, matches each certificate to the CVEs that name the same vendor and product versions. KBrain loads those matches and joins them with the CVE brain, so every related CVE comes back with its NVD severity, CVSS score, CISA KEV status and EPSS probability.
- From a CVE: list the FIPS 140-3 and Common Criteria certified products that may be affected, active certificates first.
- From a certificate: list the CVEs that may affect the certified product, with severity and exploited status.
- On every CVE page and every CVE answer, a short "certified products that may be affected" section points to the matching certificates.
The CVE matches are automated by sec-certs, not reviewed by a person. Treat them as leads to check against the vendor advisory. A certificate with no related CVE is not proof that the product is unaffected.
Who this helps
- Security teams answering "are we exposed?" for HSMs, smart cards, firewalls and crypto libraries that were bought for their certification.
- Compliance and procurement teams who need to know whether a certified product has known, exploited vulnerabilities before renewing it.
- Vendors and labs tracking how vulnerabilities touch products already on the CMVP or Common Criteria lists.
Questions to try
- "Which certified products may be affected by CVE-2021-44228?"
- "List active FIPS 140-3 modules with related CVEs that are in CISA KEV."
- "What CVEs may affect FIPS certificate 4282, and how severe are they?"
- "For these three smart card certificates, which have related critical CVEs?"
Certificate data comes from sec-certs.org, built by the Centre for Research on Cryptography and Security (CRoCS) at Masaryk University from NIST CMVP and the Common Criteria Portal. KBrain refreshes it weekly and links it to the CVE brain.
Add the Security Certifications brain to your AI assistant
Check FIPS 140-3 and Common Criteria certificates, post-quantum algorithms, and the CVEs that may affect certified products from Claude, ChatGPT, or any MCP compatible assistant. Hosted and refreshed weekly from sec-certs.org, with nothing to set up.
Questions people ask.
Does a FIPS 140-3 or Common Criteria certificate mean a product has no vulnerabilities?
No. A certificate confirms that a specific version passed an evaluation against a standard on a given date. Vulnerabilities can be found later, which is why linking certificates to CVEs is useful.
How are certificates matched to CVEs?
The sec-certs project matches each certificate to CVEs whose affected products (CPE entries) name the same vendor and product. KBrain loads those matches weekly and joins them with NVD, CISA KEV and EPSS from the CVE brain.
Can I trust the matches as a final answer?
Treat them as leads. They are automated and can miss products or include products that are not affected. Confirm with the vendor advisory or the certificate holder before acting.
Do I need both the CVE brain and the Security Certifications brain?
The Security Certifications brain already returns severity, KEV and EPSS for each related CVE. Adding the CVE brain as well lets your assistant go deeper on any one CVE, such as references, affected versions and the ENISA EUVD id.