There are many CVEs every day across multiple platforms, and browsing and creating a report tailored to your needs is much easier with the PoshCVE Module. In this blog post, I will show you how it works.
What is a CVE?
“CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws. When someone refers to a CVE, they mean a security flaw that’s been assigned a CVE ID number.
Security advisories issued by vendors and researchers almost always mention at least 1 CVE ID. CVEs help IT professionals coordinate their efforts to prioritize and address these vulnerabilities to make computer systems as secure as possible.”
Source: https://www.redhat.com/en/topics/security/what-is-cve
What does the PoshCVE module do?
You can search for information about CVE’s on https://www.cve.org/, for example, but you can also retrieve that information using the PowerShell PoshCVE module from Dan Hough. (Check the profile picture on his GitHub page using that link 😀 )
Installing the Module
You can use this to install the Module on your system:
Install-PSResource -Name PoshCVE
or, when you don’t have PSResourceGet available, you can use:
Install-Module -Name PoshCVE
After installation, there is only one cmdlet available: Get-CVE 🙂
Using PoshCVE
Parameters
After installation, you can run the Get-CVE Cmdlet with one or more Parameters:
- ID
- Specifies the ID of the CVE entry to retrieve.
- ProductType
- Specifies the type of product to search for. Valid values are Application, Hardware, or OperatingSystem.
- Vendor
- Specifies the vendor of the product to search for. opencve.io is a great place to search for these strings.
- Product
- Specifies the name of the product to search for. opencve.io is a great place to search for these strings.
- KeyWord
- Specifies a keyword to search for in the CVE entry description.
- KeyWordExact
- Indicates that the keyword search should be exact. By default, if KeyWord contains multiple words, they will be searched for anywhere in any order.
- Version
- Specifies the version of the product to search for.
- MinVersion
- Specifies the minimum version of the product to search for.
- MinVersionType
- Specifies whether the minimum version is inclusive (default) or exclusive.
- MaxVersion
- Specifies the maximum version of the product to search for.
- MaxVersionType
- Specifies whether the maximum version is inclusive (default) or exclusive.
- LastModifiedStartDate
- Specifies the start date of the last modified date range to search. Must be a [datetime] object.
- LastModifiedEndDate
- Specifies the end date of the last modified date range to search. Must be a [datetime] object. If not set and LastModifiedStartDate is specified, the current date/time will be used.
- PublishStartDate
- Specifies the start date of the publish date range to search. Must be a [datetime] object.
- PublishEndDate
- Specifies the end date of the publish date range to search. Must be a [datetime] object. If not set and LastModifiedStartDate is specified, the current date/time will be used.
- MaxResults
- Specifies the maximum number of results to return.
- FilterAffectedProducts
- Indicates whether to filter the products affected by each CVE to match the ProductType / Vendor / Product specified in the search parameters.
- APIKey
- Specifies the API key to use for the NVD API. This is optional but you may be rate limited if using the public API. You can request a free API key here: https://nvd.nist.gov/developers/request-an-api-key
Examples
Get information about a specific CVE
By running Get-CVE -ID CVE-2026-45108, you will get the information about this specific CVE about Himmelblau:
Get all Microsoft Windows 11 25H2 Critical CVEs from the last two weeks
By running Get-CVE -PublishStartDate (Get-Date).AddDays(-14) -Vendor Microsoft -Product ‘Windows_11_25H2’ -FilterAffectedProducts | Select-Object CVE, CVSSv3Severity, Published, CVSSv3Score, Description, url | Where-Object CVSSv3Score -gt 8 | Sort-Object CVSSv3Score | Format-Table -AutoSize, you will get the information about all the Windows 11 25H2 CVEs with a score higher than 8 in a formatted table:
Search for a specific keyword in the CVEs from the last week
By running Get-CVE -PublishStartDate (Get-Date).AddDays(-14) -KeyWord ‘PowerShell’ | Select-Object CVE, URL, CVSSv3Severity, Published, CVSSv3Score, Description | Sort-Object CVSSv3Score | Format-Table -AutoSize -Wrap you will get the CVEs about PowerShell in a formatted table. (I put the URL a bit to the front now because the text, even with -Wrap, was too long)
Export information to Excel
Using the Import-Excel Module, you can export all the results to a more readable format with the option to filter from that in an Excel sheet. (Use Install-PSResource / Install-Module Import-Excel first if you haven’t already) Command is Get-CVE -PublishStartDate (Get-Date).AddDays(-14) -KeyWord ‘PowerShell’ -FilterAffectedProducts | Export-Excel -Path /users/harm/Scripts/PowerShell_CVEs.xlsx -AutoFilter
I used -FilterAffectedProducts to remove that from the output. Sometimes there is more than one reference, and it will show System.Object[] because of that. (Script around that;-))
Wrapping up
And that’s how you use the PoshCVE Module to create reports or query all the CVEs in a PowerShell way. Have a lovely weekend!