Cyber Security SpaceCYBERSECURITYSPACE.NET
Security operationsCommon Vulnerabilities and Exposures

CVE

A CVE is a public identifier assigned to a specific disclosed software vulnerability so everyone can refer to the same issue unambiguously.

Updated 2 Sept 2026

In more detail

The CVE Program, run by MITRE with CVE Numbering Authorities, assigns identifiers in the form CVE-YYYY-NNNNN. A CVE record describes the affected product and versions and links to references; severity scoring and richer metadata are added in the National Vulnerability Database. A CVE is an identifier, not a severity rating and not an exploit — those are separate layers on top.

Why CVE matters

Shared identifiers are what make vulnerability management, patch advisories and software inventories interoperable: a scanner finding, a vendor bulletin and an SBOM entry can all be matched on the same string. Confusing the identifier with risk is a common mistake, which is why exploitation data such as the KEV catalogue is consulted alongside it.

How it works

A researcher or vendor requests an identifier from a CNA, usually during coordinated disclosure. Once public, the record appears in the CVE list and is enriched in the NVD with CVSS scores and CPE product identifiers. Vendors then reference the CVE in advisories, and scanners match installed versions against affected ranges.

Examples

  • A WordPress plugin advisory citing a CVE so administrators can confirm their installed version is affected.
  • A container image scan reporting CVEs from base-image packages that need a rebuild rather than an application change.

How it is detected or measured

Match your software inventory or SBOM against NVD affected-version data, then cross-reference the KEV catalogue to see which of those CVEs are known to be exploited.

Where this matters

  • Vulnerability Management

    The discipline of finding, prioritising and driving out vulnerabilities at scale — and why prioritisation, not scanning, is the job.

Sources

Related terms