What is CVE (Common Vulnerabilities and Exposures)?
Last updated: April 15, 2026
Definition
CVE (Common Vulnerabilities and Exposures) is a standardized system for identifying, naming, and cataloging publicly known security vulnerabilities in software and hardware. Created by MITRE Corporation in 1999, CVE assigns unique identifiers (CVE IDs) to each disclosed flaw, enabling security professionals, vendors, researchers, and automated tools to communicate about the same vulnerability without ambiguity. CVE entries feed the National Vulnerability Database (NVD) and form the foundation for vulnerability management, compliance frameworks, and DevSecOps automation worldwide.
Key Facts
- Also known as: CVE Program, CVE Database, CVE System
- Category: Cybersecurity (Vulnerability Management)
- Managed by: MITRE Corporation (primary CVE Numbering Authority), with CVE Numbering Authorities (CNAs) globally
- Total CVEs cataloged: 300,000+ vulnerabilities (as of 2025)
- Created: 1999 by MITRE Corporation, funded by U.S. Department of Homeland Security
- CVE ID format: CVE-[Year]-[Sequential Number] (e.g., CVE-2024-12345)
- Companion systems: National Vulnerability Database (NVD), Common Vulnerability Scoring System (CVSS)
- Related standards: NIST Cybersecurity Framework, ISO 27001, GDPR vulnerability disclosure requirements
How CVE Works
The CVE system operates through a distributed network of CVE Numbering Authorities (CNAs) that assign unique identifiers to publicly disclosed vulnerabilities. When a researcher, vendor, or end user discovers a flaw, they report it to the appropriate CNA. The CNA verifies three criteria: the vulnerability can be fixed independently, the vendor has acknowledged it, and it affects a single codebase. Once verified, the CNA assigns a CVE ID in the format CVE-[Year]-[Sequential Number].
CVE records move through three lifecycle states. Reserved means the ID is assigned but details remain embargoed while vendors develop patches. Published means the record is publicly available with a description and references to advisories. Rejected marks invalid or duplicate entries, retained to prevent confusion. Approximately 389 CNAs across 40 countries operate within defined scopes. MITRE and CISA serve as top-level roots, coordinating the hierarchy and handling vulnerabilities outside other CNAs' scopes.
CVE entries are intentionally brief. Each contains only the CVE ID, a short description, and references to vendor advisories. Technical depth, severity scores, and remediation guidance live in the National Vulnerability Database (NVD), which enriches CVE entries with CVSS scores, platform data, and impact ratings.
Why CVE Matters
Without CVE, vulnerability management devolves into chaos. Every vendor would reference the same flaw using different names, making it impossible to track patching status. CVE provides the universal reference your vulnerability scanner, SIEM and monitoring tools, and advisories use.
Over 40,000 CVEs were published in 2024, a 38% increase from 2023 (Jerry Gamblin, 2025). Security teams now triage approximately 130 new CVEs daily (Bitsight, 2025). Your patch management, compliance audits, and incident response depend on CVE as the common language. When your scanner flags CVE-2024-12345, you cross-reference it in NVD, check CISA's Known Exploited Vulnerabilities catalog, and prioritize remediation from one authoritative identifier.
The program faced a funding crisis in April 2025 when MITRE's government contract nearly expired, receiving an 11-month extension hours before the deadline. Organizations partnering with cybersecurity management services and maintaining endpoint protection and vulnerability management rely on CVE as the foundation for automated scanning, patch prioritization, and compliance reporting across their environments.
CVE vs. NVD (National Vulnerability Database)
| Aspect | CVE | NVD |
| Primary function | Assigns unique identifiers to vulnerabilities | Enriches CVE entries with analysis |
| Scope | Cataloging and identification only | Severity scoring, platform data, remediation |
| Used by | All security tools as reference | Scanners, prioritization tools, SIEM |
| Key difference | Provides the ID and description | Adds CVSS scores and impact ratings |
| When to use | To track a vulnerability | To assess severity and plan remediation |
CVE provides the identifier, NVD provides the intelligence. Security tools reference the same CVE ID, but NVD adds CVSS scores and technical depth for prioritization.
Common Misconceptions
CVE is not a vulnerability scanner. CVE is a catalog that assigns identifiers to known vulnerabilities, but it does not detect flaws in your environment. Vulnerability scanners use the CVE database as their reference to identify which CVE IDs exist on your systems.
CVE does not include severity scores or prioritization data. Each CVE entry contains only an ID, description, and references. CVSS scores, impact ratings, and remediation guidance come from the National Vulnerability Database (NVD), which enriches CVE entries with the analysis security teams need to triage and patch.
Frequently Asked Questions
Researchers or vendors report vulnerabilities to a CVE Numbering Authority, which assigns a CVE ID. The record enters Reserved status during the embargo period while vendors develop patches, then moves to Published once public.
CVE assigns the identifier, CVSS assigns the severity score. The National Vulnerability Database enriches each CVE with a CVSS score (0.0–10.0) based on exploitability and impact, enabling teams to prioritize remediation.
MITRE's government contract nearly expired in April 2025, receiving an 11-month extension (The Register, 2025). The cybersecurity industry depends on a federally-funded program vulnerable to budget cuts. The CVE Foundation and EU database emerged as alternatives.
