What CVE formats are recognized?

The standard CVE-YYYY-NNNN identifier, case-insensitively, with the modern variable-length sequence number. Both CVE-2021-44228 and cve-2021-44228 are matched and normalized.

Can I get just the CVEs out of a long mixed report?

Yes. Everything is extracted at once, then the type filter chips let you narrow to just CVEs and copy that column — no need to strip out the IPs, domains and hashes by hand.

Are duplicate CVE mentions collapsed?

Yes. A CVE cited several times across the text appears once, with a count of how often it occurred and the first line it was seen on.

Extract CVE IDs from any text — free, client-side

The sample text

This 4-line snippet is fed verbatim into the extractor to produce every result on this page. It deliberately includes a defanged indicator so you can see refang detection at work.

Patch-Tuesday roundup: actively exploited — CVE-2024-1709 (ScreenConnect auth bypass) and CVE-2023-34362 (MOVEit SQLi).
Chained with CVE-2021-44228 (Log4Shell) in the wild; scanners also probing CVE-2019-0708 (BlueKeep).
Advisory references cve-2022-30190 (Follina) — note the lower-case form is still matched.
Related infrastructure: hxxp://exploit-kit[.]top/probe hosting the CVE-2024-1709 payload.

What was extracted

The extractor found 6 unique indicators across 7 occurrences, of which 5 were CVE IDs. 1 indicator was only found after refanging — proof that defanged inputs are caught.

6unique IOCs

7total occurrences

2types found

1from defanged

Detected types

Every indicator type present in the sample, with CVE IDs highlighted. In the live tool these chips filter the table; here they show the mix the engine pulled out.

Extracted indicators

Deduped, counted, and honestly flagged. Rows marked was defanged appeared neutralized in the source and were recovered by the refang stage; private, benign and heuristic badges are kept, never silently dropped.

type	value	count	line	flags
CVE	CVE-2023-34362	1	1
CVE	CVE-2024-1709	2	1
CVE	CVE-2019-0708	1	2
CVE	CVE-2021-44228	1	2
CVE	CVE-2022-30190	1	3
URL	http://exploit-kit.top/probe	1	4	was defanged

What was detected, in context

The refanged sample with every detected indicator underlined in its type color — the same preview the live tool paints as you type.

Patch-Tuesday roundup: actively exploited — CVE-2024-1709 (ScreenConnect auth bypass) and CVE-2023-34362 (MOVEit SQLi). Chained with CVE-2021-44228 (Log4Shell) in the wild; scanners also probing CVE-2019-0708 (BlueKeep). Advisory references cve-2022-30190 (Follina) — note the lower-case form is still matched. Related infrastructure: http://exploit-kit.top/probe hosting the CVE-2024-1709 payload.

FAQ

What CVE formats are recognized?: The standard CVE-YYYY-NNNN identifier, case-insensitively, with the modern variable-length sequence number. Both CVE-2021-44228 and cve-2021-44228 are matched and normalized.
Can I get just the CVEs out of a long mixed report?: Yes. Everything is extracted at once, then the type filter chips let you narrow to just CVEs and copy that column — no need to strip out the IPs, domains and hashes by hand.
Are duplicate CVE mentions collapsed?: Yes. A CVE cited several times across the text appears once, with a count of how often it occurred and the first line it was seen on.

Extract other indicator types

See the full IOC types & defang-styles reference, or open the extractor and paste your own text.

Try it on your own text

Paste a report, advisory, or log, review the deduped indicators, filter to CVE, and copy them with one click. Free, no account, nothing uploaded — extraction runs entirely in your browser.

Open this sample in the IOC Extractor →