CVE (Common Vulnerabilities and Exposures)
What Is a CVE?
A CVE is a standard identifier assigned to a publicly disclosed security vulnerability in software or hardware. Each identifier follows the pattern CVE, year, then a number, so everyone can refer to the same flaw by the same name.
How the CVE System Works
| Step | What happens |
|---|---|
| Discovery | A researcher or vendor finds a vulnerability |
| Assignment | A CVE Numbering Authority assigns an identifier |
| Publication | The record is added to public databases with a description |
| Enrichment | Severity scores and affected versions are added |
Why CVEs Matter
CVE identifiers let scanners, advisories and patch notes line up. Teams can match the components in their software against known CVEs and prioritize fixes. Severity is commonly expressed with a CVSS score.
CVE Limitations
- A CVE does not mean the flaw is exploitable in your setup
- Not every vulnerability receives a CVE
- Severity scores can overstate or understate real risk
Context decides priority, not the score alone.
Final Thought
CVEs give the industry a shared vocabulary for vulnerabilities. They are the starting point for vulnerability management.
Frequently asked questions
Who maintains the CVE program?
The CVE Program is run by MITRE with sponsorship from the US Cybersecurity and Infrastructure Security Agency.
Is a CVE the same as a CVSS score?
No. A CVE identifies a vulnerability, while CVSS rates its severity.
Does every vulnerability get a CVE?
No. Some flaws are never reported or assigned an identifier, so CVE data is incomplete by nature.
Where can I look up a CVE?
Public sources include the CVE Program website and the National Vulnerability Database.
Should every CVE be patched immediately?
No. Teams prioritize by severity, exploitability and whether the affected code is actually used.