CVE
acronymsecuritygovernance & risk
Stands for: Common Vulnerabilities and Exposures
A public catalogue entry that uniquely identifies one specific known vulnerability.
A CVE ID (like CVE-2021-44228) gives everyone a common name for a flaw, so advisories, scanners, and patches can refer to the same thing unambiguously. It is an identifier, not a severity; that is what CVSS adds.
A CVE identifier is a unique name for a specific vulnerability, and naming is its entire job. Before it, two scanners and three vendors described the same flaw four different ways and nobody could tell whether they meant one problem or several.
What it does not carry is severity, exploitability or applicability, which is why a CVE number alone is a poor basis for a decision. The system has also strained under volume, with tens of thousands assigned per year and a growing backlog in enrichment, so an identifier existing does not guarantee the analysis behind it is complete. It is a shared vocabulary rather than an assessment, and treating the count of CVEs affecting a product as a quality measure gets the incentive backwards.
Also known as: cve, common vulnerabilities and exposures