← All articles
Web Security 2026-01-24 · 5 min read

CVEs and Outdated Software: Why Version Numbers Matter

A CVE (Common Vulnerabilities and Exposures) is a publicly catalogued security flaw with a unique ID, such as CVE-2021-44228 (Log4Shell). Once a CVE is published, exploit code often follows within days — and automated scanners hunt the internet for unpatched systems.

Why disclosed software versions are risky

When a server advertises its exact version in response headers (for example Server: Apache/2.4.49), an attacker can instantly match it against known CVEs. This is why hiding version banners and, more importantly, patching promptly both matter.

Staying ahead

  • Keep your web server, language runtime (PHP, Node), CMS and plugins updated.
  • Subscribe to security advisories for the software you run.
  • Suppress version disclosure: ServerTokens Prod on Apache, server_tokens off; on Nginx, expose_php = Off in PHP.
  • Re-scan after updates to confirm the fix.

Our scanner matches detected software against known CVEs and links each to its NVD entry for verification.

Put this into practice
Run a free, private scan — no login, nothing stored.
🛡 Web Scan 🔒 SSL/TLS 📬 MX & Email 🎣 URL Check

Related articles

Web Security What Is a Web Application Firewall (WAF) and Do You Need One? A WAF filters malicious traffic before it reaches your app. Learn what it catches, what it does not, and when it is worth it. Web Security Open Ports: What They Reveal and Which Ones to Close Every open port is a potential door. Here is how to think about port exposure and reduce your attack surface. Web Security Exposed .git, .env and Backup Files: A Silent Data Leak Misconfigured servers often expose source code, credentials and backups to anyone who asks. Here is how to find and stop it.