CVE

CVE stands for Common Vulnerabilities and Exposures: a worldwide catalog of publicly known vulnerabilities in software and hardware. Every registered vulnerability receives a unique identifier, such as CVE-2021-44228, so that everyone is talking about the same flaw.

What it means

A CVE ID consists of the prefix CVE, the year of assignment, and a sequence number: CVE-2024-3094 is therefore a vulnerability registered in 2024. The CVE program has existed since 1999 and is operated by MITRE, a US non-profit organization, on behalf of the US cybersecurity agency CISA, which funds it. That dependence showed in April 2025, when the contract nearly lapsed and CISA extended it at the last minute. CISA says the program is now fully funded; members of the CVE Board have meanwhile set up the CVE Foundation to give it a broader, independent funding base.

The identifiers are issued by so-called CVE Numbering Authorities (CNAs): software vendors, security companies, and research institutes that may assign IDs for vulnerabilities in their own domain. A CVE record contains a short description, the affected products, and references to advisories. The US National Vulnerability Database (NVD) has long enriched those records with, among other things, a CVSS score expressing the severity. Since April 2026, faced with a surge in submissions, NIST does so only for priority CVEs, such as those known to be exploited, and no longer routinely adds a score of its own when the CNA has supplied one. In Europe, ENISA has run the European Vulnerability Database (EUVD) since May 2025; it combines CVE data with information from vendors and national CSIRTs.

Why it matters

Without shared naming, every security company would call the same flaw something different, exactly the problem that existed before 1999. Thanks to CVE IDs, scanners, patch management tools, advisories, and news reports can all point to exactly the same vulnerability. For administrators, the CVE ID is the starting point: you look it up in the vendor’s advisory or in a database such as the NVD or EUVD, see which versions are affected, and check whether a patch or workaround is available.

Keep in mind that not every vulnerability has a CVE. Flaws that are never publicly reported, such as zero-days exploited in silence, are not registered anywhere. A clean CVE search therefore does not mean your software is safe.

Example

One of the best-known examples is CVE-2021-44228, better known as Log4Shell: a vulnerability in the Java logging library Apache Log4j, disclosed in December 2021, with the maximum CVSS score of 10.0. Because the flaw had one clear identifier, organizations worldwide could check within hours whether their software was affected and patch accordingly.