A CVE, short for Common Vulnerabilities and Exposures, is a public catalog that gives each known security vulnerability a single, unique ID. That ID looks like CVE-2021-44228, the identifier for the Log4Shell flaw. The point is a shared name: before CVE, the same bug might be called different things in different scanners and advisories, which slowed everyone down. The CVE Program, created by MITRE in 1999 and now sponsored by CISA, fixes that with one canonical ID per flaw. Organizations called CVE Numbering Authorities assign the IDs, and a published record includes an ID, a description, and at least one reference. Importantly, a CVE is an identifier, not a severity score and not proof of an attack. This guide explains what a CVE is, how the IDs are assigned, and how CVE fits with CVSS, the NVD, and CISA's KEV.
Key takeaways
- CVE stands for Common Vulnerabilities and Exposures, a public catalog of known flaws.
- Each vulnerability gets a unique ID in the form CVE-YEAR-NUMBER, like CVE-2021-44228.
- The program was created by MITRE in 1999 and is sponsored by CISA; CNAs assign the IDs.
- A CVE is an identifier, not a severity score (CVSS) or proof of exploitation (KEV).
- The list is free and public and underpins most scanners, SIEMs, and patch tools.
Quick explanation
In simple terms
A CVE is a public ID card for a known software or hardware security flaw. It gives the flaw one name and short description so everyone can talk about the same thing.
Technical definition
A CVE is an entry on the CVE List, a public catalog of disclosed cybersecurity vulnerabilities run by the CVE Program. Each entry has a unique CVE ID (CVE-YEAR-NUMBER), a description, and at least one public reference, and is assigned by a CVE Numbering Authority within its scope.
Analogy
Think of a CVE ID like an ISBN for a book. It doesn't tell you if the book is good or bad, just which exact book it is, so every store and library can point to the same title without confusion.
Definition
A CVE, short for Common Vulnerabilities and Exposures, is a public catalog of known security vulnerabilities. Each entry gets a unique ID, like CVE-2021-44228, so that everyone, from vendors to scanners to analysts, refers to the same flaw by the same name.
CVE stands for Common Vulnerabilities and Exposures. It is both a program and a public list that identifies, defines, and catalogs publicly disclosed cybersecurity vulnerabilities. Each vulnerability on the list gets a unique CVE ID in the form CVE-YEAR-NUMBER, for example CVE-2021-44228, the ID for the Log4Shell flaw.
The CVE Program was created by the MITRE Corporation in 1999. Today it is sponsored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and operated by MITRE. Its goal is a common reference: before CVE, one flaw might have several names across different tools and advisories, which made coordination slow and error-prone.
IDs are assigned by CVE Numbering Authorities (CNAs), organizations authorized to issue CVE IDs within a defined scope. There are hundreds of CNAs worldwide, including software vendors, open-source projects, bug bounty platforms, and national CERTs. A published CVE record contains at least a CVE ID, a description, and one public reference.
A CVE is an identifier, not a severity score. Severity comes from a separate system, CVSS, and other data sources enrich CVE records: the National Vulnerability Database (NVD) adds scores and metadata, and CISA's Known Exploited Vulnerabilities (KEV) catalog flags which CVEs are being exploited. The CVE list is free and public, and it underpins nearly every scanner, SIEM, and patch tool in use.
Why it matters
Core concepts
The CVE ID and its format
A CVE ID is the unique public identifier for one vulnerability, in the form CVE-YEAR-NUMBER.
Every CVE has an ID like CVE-2021-44228. It has three parts: the prefix CVE, the year the ID was assigned or reserved, and a sequence number. Together they form one unique label for a single vulnerability.
The sequence number has at least four digits and can be longer, so the scheme scales as the number of vulnerabilities grows. The year is when the ID was created, which is not always the same year the flaw became public.
Example
CVE-2021-44228 is the ID for the Log4Shell vulnerability in Apache Log4j.
Why it matters — The ID is the shared reference every tool and team uses, so its structure is worth knowing.
The CVE List is a catalog, not a scanner
The CVE List is a public catalog that names and describes vulnerabilities; it does not scan or fix them.
The CVE List is closer to a dictionary than to a scanner or a fix. It provides one name and one short description per flaw, so different tools and databases can talk to each other. It does not detect vulnerabilities on your systems and it does not patch them.
That focus is the point. By standardizing the identifier and a basic description, CVE lets the rest of the ecosystem, from scanners to advisories, build on a shared reference instead of reinventing names.
Example
A scanner reports a finding as CVE-2021-44228, and your patch tool and threat feed use the same ID.
Why it matters — Knowing what CVE does and doesn't do prevents wrong assumptions about severity or detection.
CNAs assign the IDs
CVE Numbering Authorities are organizations authorized to assign CVE IDs within a defined scope.
CVE IDs are assigned by CVE Numbering Authorities, or CNAs. A CNA is an organization authorized by the CVE Program to issue IDs for vulnerabilities in its scope, usually its own products. There are hundreds of CNAs worldwide, including vendors like Microsoft and Red Hat, open-source projects, bug bounty platforms, and national CERTs.
The program has a hierarchy. Two top-level roots, MITRE and CISA, sit above the CNAs and govern the system. If no vendor CNA covers a flaw, MITRE acts as the CNA of last resort so an ID can still be issued.
Example
Microsoft, as a CNA, assigns CVE IDs to vulnerabilities in its own products.
Why it matters — Knowing who assigns IDs explains why coverage and quality can vary by product and vendor.
The record lifecycle: reserved, published, rejected
A CVE record moves through states, from a reserved ID to a published record, or to rejected.
A CVE record has a lifecycle. First an ID is Reserved, often before details are public, so everyone can coordinate around the same number. When the CNA fills in the required data, an ID, a description, and at least one public reference, the record becomes Published.
Not every reserved ID becomes a valid entry. If an ID should no longer be used, for example because it was a duplicate or not a real vulnerability, it is marked Rejected but stays on the list so people know it is invalid. A record can also be Disputed if a vendor challenges it.
Example
A reserved CVE ID appears with no details until the vendor publishes the full record.
Why it matters — The states explain why some CVE IDs have little or no public detail at a given moment.
CVE within the wider ecosystem
CVE is the identifier layer; other systems add severity, weakness type, and exploitation data.
A CVE is one piece of a larger ecosystem. The National Vulnerability Database (NVD), run by NIST, enriches CVE records with severity scores, weakness types, and product data. CVSS, managed by FIRST, provides the severity score from 0.0 to 10.0. CWE categorizes the type of weakness.
CISA's Known Exploited Vulnerabilities (KEV) catalog flags which CVEs are actually being exploited. Each system answers a different question, and they all key off the CVE ID as the common reference.
Example
You look up a CVE ID in the NVD for its CVSS score and check KEV to see if it is exploited.
Why it matters — Understanding the layers stops people from expecting a CVE to do a job that another system does.
What a CVE is not
A CVE is an identifier and description; it is not a severity rating, an exploit, or a fix.
It helps to be clear about the limits. A CVE does not rate how dangerous a flaw is; that is CVSS. It does not tell you whether attackers are using it; that is the KEV catalog. It does not describe the class of mistake behind it; that is CWE. And it does not fix anything.
A CVE is simply the shared identifier and basic record. Everything else, scoring, exploitation status, and remediation, is layered on top by other systems and by vendors.
Example
A high CVE number says nothing about severity; you still need the CVSS score to judge risk.
Why it matters — Knowing the boundaries keeps triage accurate and prevents over- or under-reacting to a CVE.
How it works
A vulnerability is discovered
A researcher, vendor, user, or automated tool finds a potential security vulnerability in a software or hardware product.
Discovery
Example — A researcher finds a flaw in a widely used library during a security review.
It is reported to a CNA
The finder reports the vulnerability to an appropriate CVE Numbering Authority, often the product's vendor, or to MITRE as the CNA of last resort.
Report
Example — The researcher submits details to the vendor, which is a CNA for its own products.
A CVE ID is reserved
The CNA reserves a CVE ID for the vulnerability. The ID exists so everyone can coordinate around it, even before details are public.
Reserve
Example — The CNA reserves an ID, which shows as reserved until the record is published.
Disclosure is coordinated
The vendor and reporter coordinate a fix and a disclosure timeline, so the details go public responsibly, usually alongside a patch.
Coordinate
Example — The vendor prepares a patch while the ID stays reserved during the embargo.
The CNA publishes the record
The CNA publishes the CVE record with the required data: the CVE ID, a description, and at least one public reference. It appears on the CVE List.
Publish
Example — The published record on cve.org includes the description and links to the advisory.
Other systems enrich and use it
The NVD and others add CVSS scores, CWE types, and product data, and downstream tools use the CVE ID to report, correlate, and prioritize.
Enrich and use
Example — The NVD adds a CVSS score, and scanners flag affected systems by the CVE ID.
Use cases
Unambiguous communication about a flaw
All security and IT teamsRefer to a specific vulnerability by one shared ID across teams, vendors, and tools.
Everyone discussing Log4Shell can point to CVE-2021-44228 and mean the same thing.
Benefit — Removes confusion when many names could describe the same flaw.
Correlating findings across tools
SOC and vulnerability managementMatch scanner results, SIEM alerts, and advisories that all reference the same CVE ID.
A scanner finding and a threat feed both cite one CVE ID, so they correlate cleanly.
Benefit — Lets disparate tools line up on the same vulnerability automatically.
Prioritizing patches
IT admins, MSPsUse the CVE ID to pull severity from CVSS and exploitation status from KEV to rank fixes.
You patch a KEV-listed CVE with a high CVSS score before lower-risk ones.
Benefit — Turns a list of flaws into a defensible patch order.
Coordinating disclosure
Vendors, researchersReserve a CVE ID early so all parties reference the same number during a disclosure.
A reserved CVE ID anchors emails and advisories before the flaw goes public.
Benefit — Keeps a coordinated fix and announcement aligned across organizations.
Compliance, audit, and SBOM tracking
GRC teams, developersTrack known vulnerabilities in software components and report them by CVE ID.
An SBOM tool lists affected components by their CVE IDs for review.
Benefit — Gives auditors and pipelines a precise, machine-readable reference.
Benefits
One universal identifier
Each flaw gets a single canonical ID, so everyone refers to it the same way.
CVE-2021-44228 means the same thing in every scanner, feed, and advisory.
Interoperability across tools
Because tools key off the CVE ID, their data lines up automatically.
A SIEM correlates a scanner finding and a threat feed by a shared CVE ID.
Free and public
The CVE List is openly available, with no license or fee to use the identifiers.
Any team or product can download and use CVE data at no cost.
Supports coordinated disclosure
Reserving an ID early lets researchers and vendors coordinate around one reference.
A reserved ID keeps all parties aligned before a flaw is public.
Foundation for prioritization
The CVE ID is the anchor that CVSS, KEV, and vendor advisories attach risk data to.
Patch tools rank fixes using CVSS and KEV data tied to each CVE ID.
Limitations
No severity on its own
MediumA CVE is an identifier and description, not a severity rating. You need CVSS, from FIRST, to judge how serious a flaw is.
Workaround — Look up the CVSS score, usually via the NVD, alongside the CVE ID.
No exploitation status
MediumA CVE does not tell you whether attackers are using the flaw. Most CVEs are never exploited in the wild.
Workaround — Check CISA's Known Exploited Vulnerabilities (KEV) catalog for real-world exploitation.
Coverage gaps
MediumNot every bug gets a CVE. It must be a publicly disclosed vulnerability in an in-scope product, and some flaws are rejected, duplicated, or never assigned.
Workaround — Combine CVE data with vendor advisories and other sources for fuller coverage.
Enrichment delays
MediumExtra data like CVSS scores can lag. Enrichment backlogs in recent years have left many records without full metadata for a time.
Workaround — Supplement with vendor advisories, CISA data, and other feeds when the NVD lags.
Quality varies
LowRecords differ in detail and accuracy across CNAs, and some IDs are disputed or turn out to be invalid and get rejected.
Workaround — Read the record and references, and treat disputed or thin entries with care.
Architecture
The CVE system is a small ecosystem of roles built around one shared identifier. A reporter finds a flaw, a CNA assigns and publishes the ID, the CVE Program governs the list, the NVD and other databases enrich the record, and downstream tools consume the ID. CISA sponsors the program and MITRE operates it.
Reporter or researcher
Discovers the vulnerability and reports it to a CNA to start the process.
A security researcher who finds and responsibly reports a flaw.
CVE Numbering Authority (CNA)
Assigns the CVE ID within its scope and publishes the record with a description and references.
A vendor issuing a CVE ID for a flaw in its own product.
CVE Program and Top-Level Roots
Governs the list, the CNA hierarchy, and the record format; MITRE and CISA are the top-level roots.
MITRE operating the program and acting as the CNA of last resort.
CVE List on cve.org
Holds the authoritative record for each CVE ID: description and public references.
The published entry a tool links to for a given CVE ID.
NVD and other data sources
Enrich CVE records with CVSS scores, CWE types, and product data; KEV flags exploitation.
The NVD adding a CVSS score to a newly published CVE.
Data flow
A reporter sends a vulnerability to a CNA. The CNA reserves a CVE ID, then, after coordinated disclosure, publishes a record with a description and references to the CVE List on cve.org. The NVD and other sources read that record and enrich it with CVSS scores, CWE types, and product data, while CISA's KEV catalog flags exploitation. Downstream scanners, SIEMs, and patch tools then use the CVE ID to report and correlate findings.
Integrations: Vulnerability scanners and attack surface tools, SIEM and threat intelligence platforms, Patch and vulnerability management systems, The NVD, CVSS (FIRST), CWE, and CISA KEV, Vendor security advisories and SBOM tools
Architecture limitations
Examples
Referencing Log4Shell
A critical flaw hits a widely used logging library and needs urgent coordination.
The Log4Shell vulnerability in Apache Log4j got the ID CVE-2021-44228. That single ID let vendors, scanners, advisories, and news all point to the exact same flaw, which made a fast, coordinated response possible across the industry.
A vendor acting as a CNA
A software vendor discloses a flaw in one of its own products.
As a CNA, the vendor assigns a CVE ID from its scope, writes the description and references, and publishes the record. Because the vendor knows its product best, the record is accurate, and customers get a clean ID to track and patch against.
Prioritizing with CVSS and KEV
You have dozens of new CVEs and limited time to patch.
You take each CVE ID, pull its CVSS score from the NVD, and check CISA's KEV catalog for exploitation. A CVE that is both high-scoring and KEV-listed goes to the top of the patch list. The CVE ID is the key that ties all that context together.
Comparisons
CVE vs CVSS vs CVSS (Common Vulnerability Scoring System)
A CVE identifies a vulnerability; CVSS scores how severe it is. CVE is run by the CVE Program; CVSS is maintained by FIRST and produces a number from 0.0 to 10.0. You use the CVE ID to look up the CVSS score.
| Criterion | CVE vs CVSS | CVSS (Common Vulnerability Scoring System) |
|---|---|---|
| What it is | A unique identifier and record | A severity score from 0.0 to 10.0 |
| Maintained by | The CVE Program (MITRE, CISA) | FIRST |
| Answers | Which flaw is this? | How severe is it? |
When to choose — Use the CVE ID to name a flaw and the CVSS score to judge its severity; you need both.
CVE vs the NVD vs National Vulnerability Database (NVD)
The CVE List is the catalog of IDs and basic records, run by MITRE. The NVD, run by NIST, syncs with CVE and enriches each record with CVSS scores, weakness types, and product data. They are related but distinct.
| Criterion | CVE vs the NVD | National Vulnerability Database (NVD) |
|---|---|---|
| Role | The list of IDs and basic records | An enriched database built on CVE |
| Run by | MITRE (CVE Program) | NIST |
| Adds | ID, description, references | CVSS, CWE, product (CPE) data |
When to choose — Use CVE for the canonical ID and the NVD for enriched scoring and metadata.
CVE vs CWE vs CWE (Common Weakness Enumeration)
A CVE is a specific vulnerability in a specific product. A CWE is a category of weakness, like a class of coding mistake. One CWE type can apply to many CVEs, and a CVE record may reference a CWE.
| Criterion | CVE vs CWE | CWE (Common Weakness Enumeration) |
|---|---|---|
| Scope | One specific vulnerability instance | A class or type of weakness |
| Example | CVE-2021-44228 in Log4j | A weakness category such as injection |
When to choose — Use CVE to name a specific flaw and CWE to describe the kind of weakness behind it.
Myths, corrected
Myth
A CVE tells you how severe a vulnerability is.
Correction
It doesn't. A CVE is an identifier and description with no severity rating. Severity comes from CVSS, a separate system maintained by FIRST that scores a flaw from 0.0 to 10.0. A high CVE number says nothing about risk.
Why it happens: People see CVE and CVSS together in tools and assume they are the same thing.
Myth
A CVE means the vulnerability is being exploited.
Correction
Not at all. A CVE only means a flaw was disclosed and given an ID. Whether attackers are using it is tracked separately by CISA's Known Exploited Vulnerabilities catalog, and most CVEs are never exploited in the wild.
Why it happens: News often pairs a CVE with an active attack, so the two blur together.
Myth
CVE and the NVD are the same thing.
Correction
They are related but distinct. The CVE List, run by MITRE, is the catalog of IDs and basic records. The NVD, run by NIST, syncs with CVE and adds CVSS scores, weakness types, and product data on top.
Why it happens: Many people first meet CVE data through the NVD's website, so they conflate the two.
Myth
Every security bug gets a CVE.
Correction
No. A CVE is for a publicly disclosed vulnerability in an in-scope product that meets the criteria. Some flaws are rejected, duplicated, or never assigned, and a reserved ID may exist with no public details yet.
Why it happens: CVE is so common that people assume every flaw automatically has one.
Practical implications
For admins
Track and patch by CVE ID, and always pair it with a severity source. Reading the CVE record and its references tells you which products and versions are affected.
For MSPs
Standardize on CVE IDs across all client environments so scanners, tickets, and reports speak the same language. It makes cross-client vulnerability reporting consistent and auditable.
For business
CVE data is free and universal, so the cost is mainly the tooling and process to act on it. The payoff is faster, clearer response and stronger compliance evidence.
For security
Use the CVE ID as the anchor, then layer CVSS for severity and KEV for exploitation to prioritize. Don't treat a CVE alone as a risk verdict.
For end users
End users rarely see CVE IDs directly. They benefit through the patches and advisories that reference them, which keep their software secure.
Cost impact
The CVE list itself is free to use. Costs come from the scanners, feeds, and staff time needed to turn CVE data into action, which is standard vulnerability-management spend.
Operational impact
CVE IDs are woven through scanning, ticketing, and patching. Consistent use speeds correlation and reporting; inconsistent use creates gaps and duplicate work.
Decision guide
Use when
- You need to refer to a specific disclosed vulnerability unambiguously
- You're correlating findings across scanners, SIEMs, and advisories
- You're tracking or prioritizing patches in your environment
- You're coordinating a disclosure and want a shared reference
Avoid when
- You need a severity rating (use CVSS)
- You need exploitation status (use CISA's KEV catalog)
- You need the class of weakness (use CWE)
- The flaw is private, undisclosed, or out of CVE scope (use vendor advisories)
Requirements
- A publicly disclosed vulnerability in an in-scope product
- A CVE Numbering Authority to assign the ID, or MITRE as last resort
- Access to the CVE List and, for enrichment, the NVD
- Tools that key off CVE IDs for correlation
Alternatives
- Vendor security advisories for product-specific detail
- GitHub Security Advisories (GHSA) for open-source projects
- The OSV database for open-source vulnerabilities
- Regional databases such as the European EUVD
Related terms
CVE Numbering Authority (CNA)
An organization authorized by the CVE Program to assign CVE IDs within a defined scope.
CVSS
The Common Vulnerability Scoring System, maintained by FIRST, which rates severity from 0.0 to 10.0.
National Vulnerability Database (NVD)
The NIST database that syncs with CVE and enriches records with scores and metadata.
CWE
The Common Weakness Enumeration, a catalog of weakness types that can underlie many CVEs.
KEV catalog
CISA's Known Exploited Vulnerabilities catalog, which flags CVEs being exploited in the wild.
MITRE
The organization that created and operates the CVE Program, sponsored by CISA.
Frequently asked questions
What does CVE stand for?
CVE stands for Common Vulnerabilities and Exposures. It is a public program and list that gives each known cybersecurity vulnerability a unique identifier and basic record.
What does a CVE ID look like?
A CVE ID has the form CVE-YEAR-NUMBER, for example CVE-2021-44228, the ID for Log4Shell. The number has at least four digits and can be longer as more vulnerabilities are recorded.
Who assigns CVE IDs?
CVE Numbering Authorities (CNAs) assign them. These are organizations authorized by the CVE Program to issue IDs within a scope, usually their own products. MITRE and CISA are the two top-level roots that govern the system.
Is a CVE the same as a CVSS score?
No. A CVE is an identifier and description for a flaw. CVSS is a separate severity score from 0.0 to 10.0, maintained by FIRST. You use the CVE ID to look up its CVSS score.
What's the difference between CVE and the NVD?
The CVE List, run by MITRE, holds the IDs and basic records. The National Vulnerability Database, run by NIST, syncs with CVE and enriches each record with CVSS scores, weakness types, and product data.
Does a CVE mean I'm being attacked?
No. A CVE only means a vulnerability was disclosed and identified. Whether it is being exploited is tracked separately in CISA's Known Exploited Vulnerabilities catalog, and most CVEs are never exploited in the wild.
Is the CVE program free to use?
Yes. The CVE List is publicly available at no cost, which is why it is built into nearly every scanner, SIEM, and patch tool.
Who runs the CVE program?
The CVE Program was created by the MITRE Corporation in 1999. Today it is operated by MITRE and sponsored by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
Conclusion
CVE, Common Vulnerabilities and Exposures, is a public catalog that gives each known security vulnerability a unique ID like CVE-2021-44228. The program was created by MITRE in 1999 and is sponsored by CISA, and CVE Numbering Authorities assign the IDs. A published record holds an ID, a description, and at least one reference.
The key thing to remember is what a CVE is and isn't. It is the shared identifier that ties the ecosystem together, but severity comes from CVSS, exploitation from CISA's KEV catalog, weakness types from CWE, and enriched data from the NVD. Use the CVE ID as your anchor, then layer those sources to judge and prioritize risk.
Main takeaway
If you want to act on CVEs, the natural next steps are an explainer on CVSS scoring and how to read a severity vector, and a guide to risk-based patching that combines CVSS with CISA's KEV catalog.
