Glossary
CVE
CVE stands for Common Vulnerabilities and Exposures: the public numbering system that gives each known software vulnerability its own ID.
What it means
CVE stands for Common Vulnerabilities and Exposures: the public numbering system that gives each known software vulnerability its own ID. A CVE ID looks like CVE-2026-12345 — the year it was published, and a unique number. Behind every CVE is a CNA, a numbering authority that assigns the ID, and a public record describing the flaw in standardised terms. The system exists so that everyone — researchers, vendors, defenders — can talk about the same vulnerability in the same words.
How it works
A CVE record describes what the vulnerability is, which products and versions are affected, and how it can be exploited in general terms — never exploit code. Severity is scored separately, most often with CVSS, which rates how bad a vulnerability is in the abstract; a high score does not automatically mean you are the most urgent person to patch. Professionals connect a CVE to a practical question — should I patch first? — using two further sources: the CVSS score, and CISA's Known Exploited Vulnerabilities list, which tracks the flaws attackers are actually using. A vulnerability on the KEV list is usually a better priority than a high CVSS score that nobody is exploiting. The CVE decoder tool explains an ID's format, what the year and number mean, and links to the official records — CVE.org, the NVD, and CISA KEV — so you can check a CVE yourself.
Example
Imagine a fictional small company whose IT manager, Dana, reads that a vulnerability in their web server has a CVE ID and a severity score of 9.8 — nearly the maximum. Her first instinct is to drop everything and patch immediately. But she checks the KEV list first: the flaw is not on it, and their server is not exposed to the internet in the way the flaw requires. The patch is still important and still scheduled — but the emergency patch of a different flaw, one with a lower score that is already being exploited, comes first. The CVE ID named the problem; the scores and the KEV list set the order.
Common misunderstandings
The most common misunderstanding is that a CVE with a high severity score is automatically the most urgent. It is not: severity measures how bad the flaw is in the abstract, not how likely you are to be attacked through it. A flaw that needs a condition you do not have is less urgent than a moderate flaw attackers are actively using. The second misunderstanding is that a CVE means the software is broken beyond repair — most CVEs are flaws that have a fix, and the CVE system exists precisely so the fix can be found and applied.
Related terms
Learn more
- What is a CVE ID?
- MITRE ATT&CK explained
- Security research for beginners
- Threat Intelligence Introduction
- Back to the full glossary
Last checked: 14 November 2026.
Frequently asked questions
What does the year in a CVE ID mean?
The year the CVE ID was published — not necessarily the year the flaw was found or fixed. The number after it is a unique sequence within that year.
Does a high severity score mean I should patch first?
Not necessarily. Severity measures how bad the flaw is in the abstract. Whether you should patch first depends on whether the flaw affects your systems and whether attackers are actually using it — and CISA's Known Exploited Vulnerabilities list is often a better priority guide.
Where can I check a CVE myself?
The official records are CVE.org and the US National Vulnerability Database, with the CISA KEV list for exploitation status. Our CVE decoder tool explains an ID's format and links to those official sources — it does not fetch live data itself.