Common Vulnerabilities and Exposures (CVE) Definition
Text
Common Vulnerabilities and Exposures (CVE) is a standardized system for identifying and cataloging publicly disclosed cybersecurity vulnerabilities in software, hardware, and firmware. Each vulnerability is assigned a unique CVE ID that acts as a universal reference, giving security teams, vendors, and researchers a common language to track and discuss the same flaw consistently across tools and organizations.
Created by the MITRE Corporation in 1999 and sponsored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the CVE list works like a dictionary rather than a database it names and briefly describes each flaw, while deeper details like severity scores live in the National Vulnerability Database (NVD).
What does CVE stand for in cyber security?
Text
CVE stands for Common Vulnerabilities and Exposures. In cybersecurity, it's the global standard for naming publicly known security flaws. Each vulnerability gets a unique CVE identifier so that everyone, security researchers, software vendors, scanning tools, and IT teams, can refer to the exact same issue without confusion. Before CVE existed, a single flaw might carry different names across different scanners and advisories, which made coordination slow and error-prone. CVE solved that by providing one canonical reference number per vulnerability.
How does the CVE system work?
Text
The CVE system works through a distributed, standardized process. When someone discovers a vulnerability, they report it to a CVE Numbering Authority (CNA), one of 300+ authorized organizations that includes MITRE plus major vendors like Microsoft, Red Hat, Google, and Oracle. The CNA validates the issue, assigns it a unique CVE ID, and reserves it while details are confirmed. Once the minimum required data is documented, affected products, versions, and at least one public reference, the CVE record is published to the public CVE list. The entry itself stays brief; enriched details like severity scores and patch links are added by databases such as the NVD.
What is the difference between CVE and CVSS?
Text
CVE and CVSS work together but do different jobs: CVE names the flaw, and CVSS scores it. A CVE is the unique identifier for a specific vulnerability, while the Common Vulnerability Scoring System (CVSS) rates that vulnerability's severity on a scale from 0.0 to 10.0, where 0.0–3.9 is Low, 4.0–6.9 Medium, 7.0–8.9 High, and 9.0–10.0 Critical. Importantly, the CVSS score isn't listed on the CVE entry itself; it's added by the National Vulnerability Database (NVD). Used together, CVE lets teams identify and track a vulnerability while CVSS helps them prioritize which ones to patch first.