What is Common Vulnerabilities and Exposures (CVE)?

Definition

CVE

What is Common Vulnerabilities and Exposures?

A CVE is a public identifier for one specific known vulnerability in a product, formatted CVE-YYYY-NNNNN. It names the flaw so tools and advisories can refer to the same issue; it does not score it.

A public catalog of disclosed security vulnerabilities, each assigned a unique identifier in the format CVE-YEAR-NUMBER (e.g., CVE-2021-44228 for Log4Shell). Maintained by MITRE and funded by the US government, CVE identifiers provide a standardized reference for discussing, tracking, and remediating specific vulnerabilities across vendors, tools, and security advisories. All CVE entries are publicly searchable via the National Vulnerability Database (NVD).

Related terms

CVSS Score →

A standardized numerical score from 0 to 10 that rates the severity of a security vulnerability based on its exploitability and potential impact.

Zero-Day Vulnerability →

A software vulnerability that has been discovered but not yet publicly disclosed or patched by the vendor, leaving affected systems with no available fix at the time it is known or exploited.

Vulnerability Assessment →

A systematic process of identifying, classifying, and prioritizing security weaknesses in a system without attempting to exploit them.

Exploit →

A piece of software, command sequence, or technique that leverages a known vulnerability to cause unintended or unauthorized behavior in a target system.

Put this into practice

Autonomous OWASP vulnerability scanning →

See how Penetrify's autonomous AI agents find and validate this class of security issue in your application.