CVE (Common Vulnerabilities and Exposures)

CVE is a standardized naming system for publicly known security vulnerabilities, coordinated by MITRE and CISA. Each entry gets a unique ID in the form CVE-YEAR-NUMBER, plus a short description and references. The ID is just an identifier — it does not by itself say how severe or exploitable the flaw is.

CVE Numbering Authorities (CNAs) — organizations such as vendors, open-source projects, and security researchers — assign IDs and publish the initial record. Downstream databases like the NVD then enrich each CVE with severity scores (CVSS), affected version ranges, and links, making the record actionable for scanners and defenders.

For developers, CVEs are the common language of dependency and vulnerability management. When a scanner reports that a library is affected by a CVE, that ID lets you look up the fix, the affected versions, and any exploit intelligence. Because a raw CVE says nothing about your specific exposure, teams combine it with severity (CVSS), exploit probability (EPSS), known-exploited status (CISA KEV), and reachability to decide what to fix first.