Find the exact product name and version, read the vendor's security notices for that product, check whether CISA's Known Exploited Vulnerabilities list names it, and install the latest update. Those four steps answer the question for most everyday software without special tools.
Step 1: Know what you have
You cannot check what you have not named. Write down the product and its version number. Most apps show the version in Settings or an About screen. Operating systems show it in their system settings.
For a home, ten important apps is plenty to start. For a business, this becomes an inventory, and the longer it is, the more it helps to keep it in a tool.
Step 2: Read the vendor's security page
Most vendors publish security notices or release notes that say which versions are affected and which contain the fix. Look for a page called security, advisories or release notes. A vendor with no such page is itself a signal. CISA's product security bad practices guidance names not publishing a vulnerability disclosure policy as a practice to avoid.
Step 3: Check the exploited list
CISA's KEV catalog lists vulnerabilities that are known to be exploited in the wild. You can search it by vendor or product name, and download it as CSV or JSON. If your product appears, treat the update as urgent and follow the vendor's mitigation steps. If no mitigation is available, the page says to follow guidance or discontinue use.
Step 4: Update, then recheck
CISA calls keeping software current the most effective measure you can take, and recommends automatic updates where offered. After updating, confirm the new version number in the About screen.
Which source answers which question
| Question | Best source |
|---|---|
| Is my version affected? | The vendor's advisory or release notes |
| Is the flaw being used by attackers? | CISA KEV catalog |
| Is there a fix? | Vendor notice, then your update screen |
| Is my software still supported? | Vendor product page or support policy |
| What parts are inside the app? | The vendor's SBOM, if published |
What if you cannot find anything
Silence has two meanings. Either there are no known flaws, or the vendor does not publish them. To tell which, check how long ago the last update was and whether the vendor has ever posted a security notice. If neither exists, consider moving to a product that does.
A common mistake
Searching for a flaw by name and finding that the vendor has "fixed it" does not mean you have the fix. Your copy still needs the update. Always compare your version number with the fixed version in the notice.
For teams that build software
Teams hold hundreds of components in each product. Doing this by hand does not scale. Safeguard builds the inventory from your code with dependency scanning and SBOMs, matches it to advisories, and keeps watching after release. Reachability analysis helps you see which findings your code can actually trigger, and you can start with the free scan at gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
Follow a finding from detection to a fixed version and note what information each step needs.
Quick check
Where do I find my app's version number?
Usually in Settings, About or Help. On a computer, the application menu often has an About entry. Operating systems list it in system settings.
Is the KEV list all I need to check?
No. It lists exploited flaws only. Many serious flaws are not on it, so also read the vendor's notices.
Sources
- CISA: Known Exploited Vulnerabilities Catalog
- CISA: Understanding Patches and Software Updates
- CISA: Product Security Bad Practices
Last reviewed: 19 October 2026.
