CVE (Common Vulnerabilities and Exposures)

A CVE (Common Vulnerabilities and Exposures) is a standardized identifier in the form CVE-YEAR-NUMBER given to a specific publicly known security flaw, so everyone can refer to the same issue consistently.

Why it matters

CVE IDs let vendors, scanners, advisories and administrators match a flaw to affected products and fixes. Databases such as the NVD add severity scores and details. A CVE entry identifies a vulnerability, it does not say how bad it is or whether a patch exists, so you still need to read the advisory.

Example

CVE-2021-44228 is the identifier for the Log4Shell flaw in the Apache Log4j library. Searching that ID returns vendor advisories, affected versions and the fixed releases.

Common mistakes

• Assuming every vulnerability has a CVE. Many are never assigned one.
• Reading a high CVSS score as the same thing as high risk for your environment.
• Ignoring CVEs in dependencies because you did not write the code.

Related

• Vulnerability
• Patch
• Zero-day
• Security audit

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.