CVE (Common Vulnerabilities and Exposures)
Also known as: CVE, CVE ID, Common Vulnerabilities and Exposures, CVE number
CVE, short for Common Vulnerabilities and Exposures, is a public catalogue that gives each known security flaw a unique identifier, such as CVE-2021-44228 for the Log4Shell bug.
Those IDs let vendors, security teams, and tools all refer to the exact same problem. While CVEs are the backbone of vulnerability management, a CVE number says nothing on its own about how dangerous a flaw is, and the program's funding scare in 2025 showed how fragile this shared infrastructure can be.
CVE (Common Vulnerabilities and Exposures), explained at three levels
At home
A CVE is like a case number at a police station. When someone discovers a security flaw, an official body gives it a unique ID, such as CVE-2021-44228, plus a short description of what's affected. From then on, news stories, software updates, and security tools all use that same number, so everyone knows they're talking about exactly the same problem.
At work
A CVE is a unique ID assigned to a publicly known security flaw, along with a short note on which products and versions it affects. IT teams use these IDs as a common language: scanners report which CVEs are present on company machines, vendors list which CVEs each patch fixes, and staff can match the two to confirm nothing important is left unpatched.
At home
A CVE ID is a name tag, not a judgment of danger. When someone reports a security flaw, an organization called a CVE Numbering Authority, often the software vendor itself, checks it and assigns the next ID, such as CVE-2024-3094. The record then describes which products and versions are affected. Release notes, news stories and security tools all use that same ID, so when your phone update lists the CVEs it fixes, you can look each one up and see what it was.
At work
The CVE programme is run by MITRE with funding from the US government, and hundreds of CVE Numbering Authorities assign IDs within their own products. A CVE record is deliberately thin: an ID, a description and references. The severity score, affected product lists in a standard format, and weakness category usually come later from the US National Vulnerability Database or the vendor. Scanners compare the software versions they find on your machines against those enriched records to produce a list of CVEs present.
At home
While a CVE sounds alarming, the ID alone tells you nothing about whether you are at risk. The record has to be matched to the exact version you run, and many flaws only work in unusual setups or need an attacker to already be on your network. That is why a single update can fix dozens of CVEs at once. In my view, the honest takeaway for home users is that you rarely need to read CVEs at all, so long as automatic updates are on.
At work
A CVE record moves through states: reserved, published, and sometimes rejected or disputed. Since 2024 the NVD has fallen badly behind on enrichment, so many new CVEs arrive without a CVSS score or CPE product names, and scanners keyed to those fields miss them. CISA's Vulnrichment project and vendor advisories partly fill the gap. Good prioritization therefore combines the CVE with exploitation evidence such as the CISA KEV catalogue and EPSS probability scores, rather than trusting a scanner's severity column alone.
Real-world examples
At home
Fatima saw a news story urging people to update their browsers because of a CVE that attackers were exploiting. She checked for updates, and her browser installed the fix.
At work
Thomas manages vulnerabilities for a Canadian credit union. His team prioritizes CVEs on CISA's known-exploited list first, rather than just patching by severity score.
How it compares
| feature | CVE (Common Vulnerabilities and Exposures) | CVSS score |
|---|---|---|
| What it is | A unique ID for a flaw | A severity rating from 0 to 10 |
| Example | CVE-2021-44228 | 10.0 (critical) |
| Tells you | Which flaw | How severe in general |
| Doesn't tell you | Severity | Your actual risk |
The CVE names the flaw. The score estimates how bad it is.
For analysts
I'd ask IT to report patching by known-exploited CVEs, not just total counts. Fixing the flaws attackers actually use matters more than shrinking a long list.
History & origin
Before 1999, different security vendors used their own names for the same flaw, causing confusion. MITRE, a US non-profit, launched the CVE list in 1999 with funding from the US government, now through CISA. The Common Vulnerability Scoring System (CVSS) was introduced in 2005 to rate severity, and the US National Vulnerability Database adds analysis. Many organizations, called CVE Numbering Authorities, now assign IDs, including major software companies. In April 2025, MITRE warned its government contract was about to lapse; CISA extended it at the last minute, and the scare led to the creation of an independent CVE Foundation and renewed interest in alternatives such as the European Union's vulnerability database. In my view, the CVE system is a public good the whole world relies on, and it deserves stable, international funding.