What Is a CVE? Common Vulnerabilities and Exposures Explained

CVE stands for Common Vulnerabilities and Exposures. In cybersecurity, a CVE is a public catalog entry for a known security flaw in software or hardware, and every entry gets a unique ID that looks like CVE-2021-44228. When someone says they’ve patched a CVE, they mean they’ve fixed the one specific, publicly documented flaw that number points to.

Why The Catalog Exists

Imagine three weather services tracking one storm and each giving it a different name. Every forecast is accurate on its own and useless in combination; you can’t tell whether you’re looking at one storm or three.

Software security worked that way until 1999. A researcher found a bug, the vendor filed it under an internal ticket number, two scanner companies invented their own labels, and a reporter gave it a nickname. MITRE launched CVE to end the translation problem: one flaw, one name, everyone builds on top of it. CISA sponsors the program and MITRE runs it, and the records stay deliberately thin — an ID, a description, affected products, links to the vendor advisory.

MITRE doesn’t review the world’s software itself. Hundreds of CVE Numbering Authorities issue IDs within their own scope. Microsoft covers Microsoft products, the Linux kernel project covers the kernel, and national CERTs and bug bounty platforms handle what they publish. The vendor who wrote the code is usually best placed to describe what broke.

How To Read a CVE ID

CVE-2021-44228 breaks into three parts: the prefix, the year the ID was reserved, and a sequence number that means nothing beyond uniqueness.

For example, a bigger sequence number doesn’t mean a worse flaw; 44228 isn’t scarier than 0160. And the year is a filing date, not a discovery date, so a bug reserved in December and disclosed in March keeps the earlier year forever.

CVE-2021-44228 is Log4Shell. CVE-2014-0160 is Heartbleed. Nicknames come from press coverage, but only the numbers are unambiguous. In short, the number is the part you can look up.

CVE vs CWE: What’s The Difference?

The difference between CVE and CWE comes down to categories versus instances. CWE stands for Common Weakness Enumeration, and it catalogs types of coding mistakes. CVE catalogs individual instances of those mistakes in shipping products.

“Hiding a spare key under the doormat” is a class of bad idea — a CWE. “There’s a key under the doormat at 42 Elm Street” is an exploitable fact about one house — a CVE. One describes a habit, and the other tells a burglar where to go.

Both come from MITRE, and they cross-reference. When a dozen entries in your stack all map back to CWE-787, you’re looking at a memory-safety habit among your suppliers rather than a dozen unrelated accidents.

CVE vs Vulnerability: Why The Distinction Matters

The vulnerability is the unlocked door. The CVE is the address tag hanging on it.

Every CVE describes a vulnerability, and plenty of vulnerabilities never get one. Bugs in internal apps, flaws fixed before disclosure, products whose vendors don’t participate, zero-days in active use. A clean scan means no known, catalogued flaws, which is a smaller claim than “secure.”

How Do You Know If a CVE is Serious?

A CVE record tells you what broke. Whether to drop everything and patch it is a separate question, and three vulnerability scoring systems each answer part of it.

CVSS: How bad could this be?

The Common Vulnerability Scoring System rates a flaw from 0.0 to 10.0 based on the mechanics of the attack. Can an attacker reach it across the internet? Does the attacker need an existing login? Does a victim have to click something, and what do they get if it works? Anything 9.0 and up is critical, 7.0–8.9 high, 4.0–6.9 medium.

Still, the score describes the flaw in a vacuum, knowing nothing about your environment. Read it like the Richter scale — it measures the shake, not whether you live on the fault line. A 9.8 in software you don’t run is a 9.8 you can ignore, and a 5.5 on an internet-facing server holding customer data may deserve more urgency than its number suggests.

KEV: Is anyone actually using it?

CISA’s Known Exploited Vulnerabilities catalog lists flaws confirmed to be under attack in the wild. Most published flaws are never exploited by anyone. KEV is the short list of the ones that have been. If CVSS is a structural inspection of the door, KEV is a neighbor telling you someone came through it last night, and it doubles as a ready-made priority queue.

EPSS: What are the odds?

The Exploit Prediction Scoring System gives a percentage: the chance a flaw gets exploited in the next 30 days. Most sit below 1%. When one climbs into double digits, though, attackers are building tooling around it.

Together the arithmetic gets simpler. A medium-severity flaw sitting on KEV outranks a critical-severity one with no working exploit anywhere in the world. CVSS gives you the ceiling; KEV and EPSS tell you how close you are to it.

Frequently Asked Questions