Paste a build number and the installed KBs. We check them against Microsoft's own MSRC catalog — which knows exactly which update fixes which CVE — and tell you what's still outstanding.
$b=(cmd /c ver) -replace '.*\[Version (.+)\].*','$1'
$k=(Get-HotFix | % HotFixID) -join ','
"https://evil-db.io/windows?build=$b&kbs=$k"PowerShell, no admin needed. It prints a link — open it and your results load automatically. Nothing is installed and nothing leaves the machine except the build number and KB list.