CVE

CVE stands for Common Vulnerabilities and Exposures: a worldwide catalog of publicly known vulnerabilities in software and hardware. Every registered vulnerability receives a unique identifier, such as CVE-2021-44228, so that everyone is talking about the same flaw.

What it means

A CVE ID consists of the prefix CVE, the year of assignment, and a sequence number: CVE-2024-3094 is therefore a vulnerability registered in 2024. The CVE program has existed since 1999 and is operated by MITRE, a US non-profit organization, with funding from the US government.

The identifiers are issued by so-called CVE Numbering Authorities (CNAs): software vendors, security companies, and research institutes that may assign IDs for vulnerabilities in their own domain. A CVE record contains a short description, the affected products, and references to advisories. Databases such as the US National Vulnerability Database (NVD) enrich those records with, among other things, a CVSS score expressing the severity.

Why it matters

Without shared naming, every security company would call the same flaw something different, exactly the problem that existed before 1999. Thanks to CVE IDs, scanners, patch management tools, advisories, and news reports can all point to exactly the same vulnerability. For administrators, the CVE ID is the starting point: you look it up in the NVD, see which versions are affected, and check whether a patch or workaround is available.

Keep in mind that not every vulnerability has a CVE. Flaws that are never publicly reported, such as zero-days exploited in silence, are not registered anywhere. A clean CVE search therefore does not mean your software is safe.

Example

The best-known example of recent years is CVE-2021-44228, better known as Log4Shell: a vulnerability in the Java logging library Apache Log4j with the maximum CVSS score of 10.0. Because the flaw had one clear identifier, organizations worldwide could check within hours whether their software was affected and patch accordingly.