Common Vulnerabilities and Exposures (CVE) Guide

Common Vulnerabilities and Exposures (CVE) is the international cybersecurity standard for identifying, defining, and cataloging publicly disclosed cybersecurity flaws. Operated as the CVE Program, it provides universal alphanumeric identifiers that allow security teams, software vendors, and researchers across the globe to reference specific security defects with complete clarity.

What it is

The Common Vulnerabilities and Exposures (CVE) system is a publicly accessible dictionary of standardized names for publicly known information security vulnerabilities. As defined by the Committee on National Security Systems Instruction (CNSSI 4009-2022) and National Institute of Standards and Technology (NIST) Special Publication 800-128, a CVE entry is a structured record containing a unique identification number, a concise technical description, and at least one public reference citation.

Before the establishment of the CVE system, security vendors and researchers utilized proprietary naming schemes for vulnerabilities. A single software defect might carry conflicting names across commercial scanners, research advisories, and patch alerts, creating confusion in vulnerability tracking. The CVE Program established a common nomenclature, ensuring that every participant references identical defect parameters. This baseline catalog directly feeds downstream analysis platforms, most notably the National Vulnerability Database (NVD), which appends severity scoring and software configuration matching. In academic and institutional IT environments, tracking CVEs is a foundational requirement for meeting federal security mandates such as CMMC compliance for research institutions.

Because the acronym “CVE” is widely recognized, users frequently search for it across unrelated fields. Common homonyms include:

Finance and Energy Markets: The stock ticker “CVE,” which represents Cenovus Energy Inc., a Canadian integrated oil and natural gas company traded on the Toronto Stock Exchange (TSX: CVE) and New York Stock Exchange (NYSE: CVE).
Law Enforcement and Transportation: Commercial Vehicle Enforcement (CVE), the division within state police and highway patrol agencies tasked with inspecting commercial trucks, enforcing weight limits, and auditing carrier safety compliance.
Homeland Security and Policy: Countering Violent Extremism (CVE), referring to government, academic, and community programs designed to deter individuals from radicalization and extremist violence.
Licensing and Medicine: Certificate of Vision Examination, a medical verification form completed by eye care professionals for driver licensing authorities.

Who runs it and what it covers

The CVE Program is sponsored by the Cybersecurity and Infrastructure Security Agency (CISA) within the United States Department of Homeland Security (DHS). MITRE Corporation operates the program’s primary Secretariat, providing technical infrastructure and administrative stewardship. Program governance is directed by the CVE Board, an international body comprising representatives from industry, research institutions, and government agencies.

CVE assignment operates through a decentralized network of authorized organizations designated as CVE Numbering Authorities (CNAs). Over 350 CNAs operate across dozens of countries, including:

Commercial Software Vendors: Technology vendors (such as Microsoft, Red Hat, Apple, Cisco, and Google) that assign CVE IDs to vulnerabilities within their own products.
Open-Source Foundations: Projects and coordinating bodies (such as the Apache Software Foundation and Linux Foundation) managing flaws across open-source ecosystems.
Coordinators and National CERTs: Organizations like CERT/CC (Carnegie Mellon SEI), INCIBE-CERT, and JPCERT/CC that coordinate third-party research disclosures.
Top-Level Roots: Entities authorized by the CVE Board to recruit, manage, and govern sub-CNAs within specific technological or geographical scopes.

The CVE Program records vulnerabilities affecting commercial software, firmware, cloud services, open-source packages, and embedded scientific hardware. Flaws are documented using the CVE Record Format JSON 5.1 schema, which encapsulates metadata, CNA container data, affected version matrices, weakness classifications, and vendor remediation links.

How to search or use it

Security analysts, academic system administrators, and scientific software developers can retrieve CVE records directly through official web portals, the CVE Services API, or automated repository mirrors. Complementary lookup workflows are also documented in our guide on the CVE database. Follow these sequential steps:

Access the Official CVE Registry: Open the official CVE Program portal (cve.org) and locate the central search interface. Enter a known CVE identifier using the standard format: CVE-YYYY-NNNNN (e.g., CVE-2021-44228).
Perform Keyword and Vendor Searches: If the specific ID is unknown, input keywords describing the product, affected library, or flaw mechanism. The search returns matching candidate records alongside publication status.
Verify Record State: In the CVE metadata, check whether the record is marked as PUBLISHED (vulnerability details are public), RESERVED (an ID is allocated to a CNA but details remain embargoed pending a patch), or REJECTED (the candidate was determined not to be an active vulnerability or was assigned in error).
Inspect the Affected Software Container: Examine the CNA container within the record to identify specific product names, affected release ranges, and patched version numbers provided by the vendor.
Query the CVE Services REST API: Fetch structured JSON 5.1 records directly from the CVE Services endpoint:
https://cveawg.mitre.org/api/cve/CVE-YYYY-NNNNN
The API returns the machine-readable record, including assigner organization IDs, publication timestamps, and reference URLs.
Synchronize via the Official GitHub Repository: For bulk consumption without API throttling, clone or mirror the official cvelistV5 repository hosted by the CVE Project on GitHub. The repository organizes all published CVE records by year and numeric range, updating continuously as CNAs submit records.
Correlate with Downstream Threat Systems: Cross-reference the identifier with the NVD to obtain formal CVSS severity scores and CISA’s Known Exploited Vulnerabilities (KEV) catalog to determine active exploitation status.

Strengths and limits

The CVE Program serves as the foundation of modern vulnerability management, but practitioners must understand both its core advantages and practical limits.

Key Strengths:

Universal Cross-Industry Standard: Universally adopted by industry, academia, and government, eliminating naming conflicts across disparate security tools.
Decentralized CNA Ecosystem: By delegating assignment to vendor and project CNAs, the program scales globally, allowing vendors to assign IDs early during embargoed disclosure.
Open Git and API Distribution: The deployment of the CVE Services API and public GitHub repository ensures continuous, transparent access to vulnerability records in standard JSON 5.1.

Practical Limits:

No Intrinsic Severity Scoring: A CVE record describes a flaw and names affected versions, but does not assign CVSS scores or prioritize vulnerabilities; prioritization requires third-party enrichment from NVD or CISA.
Variable Quality of Descriptions: Because hundreds of independent CNAs author records, the detail and precision of descriptions can vary across software vendors.
Lag in Reservation Disclosures: Identifiers marked as RESERVED may remain unpublished for extended periods if a vendor experiences delays in coordinating a public patch.
Not a Live Exploit Feed: The CVE list records confirmed software flaws; it does not track real-time threat intelligence or active exploitation in the wild.

Alternatives

While the CVE Program is the dominant global identifier, organizations managing research computing infrastructure often cross-reference alternative vulnerability registries. The following table highlights their distinct characteristics:

Registry / System	Managing Organization	Primary Focus	Key Distinctions	Primary Application
CVE Program (CVE.org)	MITRE Corporation / CISA	Universal vulnerability identification and naming	De facto global standard; decentralized CNA assignments; JSON 5.1 schema	Universal baseline referencing across all IT assets and advisories
National Vulnerability Database (NVD)	NIST (U.S. Department of Commerce)	Vulnerability analysis and SCAP enrichment	Appends CVSS scores, CPE platform strings, CWE tags, and SSVC data	Automated institutional vulnerability scanning and compliance auditing
Open Source Vulnerabilities (OSV)	OpenSSF / Google	Open-source dependency and package flaw mapping	Precise commit-level git hashes; automated CI/CD dependency ingestion	Software supply chain security, Python/npm/Go container audits
GitHub Advisory Database	GitHub (Microsoft)	Security advisories across open-source ecosystems	Direct integration with Dependabot; maps CVEs to GHSA identifiers	Developer-facing code repository security and automated pull requests

In enterprise research computing and lab operations, cybersecurity practitioners rely on CVE identifiers as the universal index connecting vendor patch announcements with foundational cybersecurity safeguards and threat intelligence feeds.

Frequently Asked Questions

What is the definition of CVE?

Common Vulnerabilities and Exposures (CVE) is a dictionary of publicly known cybersecurity vulnerabilities. Sponsored by CISA and operated by MITRE, each CVE entry consists of an alphanumeric identifier (e.g., CVE-2021-44228), a brief description of the flaw, and public reference citations to vendor advisories or vulnerability research.

Who is behind CVE?

The CVE Program is sponsored by the Cybersecurity and Infrastructure Security Agency (CISA), an agency of the U.S. Department of Homeland Security. MITRE Corporation operates the program’s technical infrastructure and Secretariat. Governance is overseen by the CVE Board, which includes global cybersecurity experts from industry, academia, and government, with assignments executed by over 350 authorized CVE Numbering Authorities (CNAs).

What is CVE and CWE and CVSS?

CVE, CWE, and CVSS are complementary cybersecurity standards addressing different aspects of software flaws:
CVE (Common Vulnerabilities and Exposures) is the specific identifier for an individual flaw in a named product (the “what” and “where”).
CWE (Common Weakness Enumeration) categorizes the underlying coding or architectural error that created the vulnerability, such as SQL injection or out-of-bounds write (the “flaw type”).
CVSS (Common Vulnerability Scoring System) calculates a standardized numeric severity score from 0.0 to 10.0 indicating exploitability and potential impact on confidentiality, integrity, and availability (the “severity”).

What does CVE stand for in vulnerabilities?

In vulnerability management, CVE stands for Common Vulnerabilities and Exposures. It represents the global system for assigning standardized names to software, firmware, and hardware flaws so that organizations worldwide can communicate and coordinate remediation without ambiguity.

What are the four types of vulnerability?

In cybersecurity classification, vulnerabilities are commonly grouped into four primary categories:
1. Software Vulnerabilities: Flaws in application code, operating systems, or logic, such as buffer overflows, improper input validation, and race conditions.
2. Hardware and Firmware Vulnerabilities: Physical or microarchitectural flaws in processors, memory chips, or controller firmware, such as side-channel execution vulnerabilities.
3. Network and Configuration Vulnerabilities: Weaknesses arising from improper network architecture, open unnecessary ports, insecure protocols, or default credentials.
4. Human and Organizational Vulnerabilities: Process gaps, lack of security awareness, social engineering susceptibility, or inadequate access controls that permit unauthorized access.

What does CVE stand for in law enforcement?

In law enforcement, CVE stands for Commercial Vehicle Enforcement. This refers to specialized police units and state highway patrol divisions dedicated to inspecting commercial motor vehicles, monitoring cargo transport, verifying truck weight limits, and enforcing federal motor carrier safety regulations. In federal security and counterterrorism policy, CVE also refers to Countering Violent Extremism.

Sources

National Institute of Standards and Technology (NIST) Computer Security Resource Center. “Glossary: Common Vulnerabilities and Exposures (CVE).” URL: https://csrc.nist.gov/glossary/term/common_vulnerabilities_and_exposures (Read date: 2026-11-08).
MITRE Corporation / CVE Program. “CVE Services REST API 2.0 / Live Record JSON 5.1 Endpoint.” URL: https://cveawg.mitre.org/api/cve/CVE-2021-44228 (Read date: 2026-11-08).
CVE Project. “Official CVE List V5 GitHub Repository (cvelistV5).” URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2021/44xxx/CVE-2021-44228.json (Read date: 2026-11-08).
National Institute of Standards and Technology (NIST). “NIST SP 800-128: Guide for Security-Focused Configuration Management of Information Systems.” URL: https://csrc.nist.gov/pubs/sp/800/128/final (Read date: 2026-11-08).