What is CVE?
Common Vulnerabilities and Exposures (CVE) is a public list of disclosed security vulnerabilities in which each entry has a unique identifier. Before it started in 1999, every vendor and scanner named bugs its own way, and nobody could be sure two reports described the same flaw. A shared ID lets a scanner finding, a vendor bulletin, a patch ticket and a government advisory all point at exactly the same vulnerability.
The CVE Program has been run by MITRE with sponsorship from the U.S. Cybersecurity and Infrastructure Security Agency (CISA). A CVE ID only names a vulnerability. It is not a patch, and on its own it says nothing about how severe the flaw is.
How to read a CVE ID
An ID has three parts, the prefix, a year and a sequence number, as in CVE-2021-44228, the Log4Shell flaw in the Apache Log4j logging library. The year is usually when the ID was assigned or reserved, not necessarily when the flaw was found or disclosed. The sequence number has at least four digits and no upper limit, so CVE-2024-3094 and CVE-2023-34362 are both valid.
A CVE record holds the ID, a short description, the affected products and versions, and references to advisories and fixes. An ID can be reserved before details go public, so a researcher and a vendor can coordinate a fix under a known name, and a record can be rejected later if it turns out to be a duplicate or not a vulnerability.
Who assigns CVE IDs
Few IDs are assigned centrally. Most come from CVE Numbering Authorities (CNAs), organizations authorized to assign IDs and publish records within a defined scope. Many are vendors covering their own products, such as Microsoft, Cisco and Red Hat; others are open-source projects, national CERTs, bug bounty platforms and research firms. In a typical case, a researcher reports a flaw to the vendor, the vendor reserves an ID as the CNA, and it publishes the record with its security advisory on release day. A flaw in software a company wrote only for its own internal use normally gets no CVE at all.
CVE, NVD, CVSS and CWE
| Name | What it is | Run by |
|---|---|---|
| CVE | The identifier for one specific vulnerability | The CVE Program, through its CNAs |
| NVD | The National Vulnerability Database, which adds scores, weakness types and affected-product (CPE) data to CVE records | NIST |
| CVSS | The scoring standard that rates technical severity from 0.0 to 10.0 | FIRST |
| CWE | Common Weakness Enumeration, the catalog of weakness types behind vulnerabilities | MITRE |
The difference between CVE and CWE is instance versus category. CVE-2023-34362, the MOVEit Transfer flaw the Cl0p group used to steal data from many organizations in 2023, is one SQL injection vulnerability in one product. SQL injection itself, in any product, is CWE-89. Developers use CWE to avoid a class of mistake; administrators use CVE IDs to track and patch a specific flaw. Since early 2024 the NVD has had long enrichment backlogs, so many teams read the CNA's own data and vendor advisories rather than waiting for NVD analysis.
How CVE IDs are used in vulnerability management
Vulnerability scanners map their findings to CVE IDs, which lets analysts deduplicate results and group them by the patch that fixes them; one cumulative update can close a dozen CVEs on every workstation. CISA's Known Exploited Vulnerabilities (KEV) catalog is keyed by CVE ID, so a scanner can flag which findings attackers are already using. After patching, a rescan confirms the CVE no longer appears on the host.
CVE on the CompTIA Security+ exam
CVE sits under SY0-801 objective 2.1, which covers how vulnerabilities are identified and rated, and it returns in objective 4.3, vulnerability management, where scan results are analyzed and prioritized. When a scenario needs one consistent way to refer to the same flaw across a scanner report, a vendor bulletin and a ticket, the answer is the CVE ID. Keep the roles straight, because they are each other's distractors: CVE names the vulnerability, CVSS scores it, the NVD is the enriched database, and CWE names the category of weakness. A developer who wants to prevent a whole class of flaw needs CWE, not CVE. And a CVE ID alone never tells you how urgent a fix is.