Glossary
CVE
A CVE is a public identifier assigned to a specific disclosed software vulnerability so everyone can refer to the same issue unambiguously.
Updated 2 Sept 2026
In detail
The CVE Program, run by MITRE with CVE Numbering Authorities, assigns identifiers in the form CVE-YYYY-NNNNN. A CVE record describes the affected product and versions and links to references; severity scoring and richer metadata are added in the National Vulnerability Database. A CVE is an identifier, not a severity rating and not an exploit — those are separate layers on top.
Why it matters
Shared identifiers are what make vulnerability management, patch advisories and software inventories interoperable: a scanner finding, a vendor bulletin and an SBOM entry can all be matched on the same string. Confusing the identifier with risk is a common mistake, which is why exploitation data such as the KEV catalogue is consulted alongside it.
Examples
- A WordPress plugin advisory citing a CVE so administrators can confirm their installed version is affected.
- A container image scan reporting CVEs from base-image packages that need a rebuild rather than an application change.