What Is a CVE? CVE IDs, CNAs and the NVD Explained

A CVE (Common Vulnerabilities and Exposures) identifier is the standard name for a publicly disclosed security vulnerability. When two vendors, scanners and news stories talk about the same flaw, the CVE ID is what lets them be sure they mean the same thing. This guide explains how the IDs work, who assigns them and how they relate to CVSS, CWE and the NVD.

What a CVE ID looks like

A CVE ID has the form CVE-YEAR-NUMBER, for example CVE-2021-44228, the identifier for the Log4Shell flaw in Apache Log4j. The year is when the ID was reserved or assigned, which is not always the year the flaw became public. The number has at least four digits and is not a ranking or a severity.

Who assigns CVE IDs

IDs are assigned by organisations called CVE Numbering Authorities (CNAs). Many software vendors, research groups and national CERTs are CNAs for their own products, and MITRE acts as a CNA of last resort for products no one else covers. If you find a flaw in a product whose vendor is a CNA, the usual route is to report it to the vendor so they can assign the ID.

CVE record versus NVD entry

  • The CVE record holds the ID, a short description and references such as the vendor advisory.
  • The NVD (National Vulnerability Database, run by NIST) builds on CVE records with extra analysis, such as a CVSS score, a CWE weakness type and product mappings (CPE). Enrichment can lag behind publication, so a brand-new CVE may have no score yet.

The life of a CVE

  • Reserved: the ID has been set aside but details are not public yet.
  • Published: the record is public with its description and references.
  • Rejected: the ID was withdrawn, for example because it was a duplicate or not a security issue.

CVE, CVSS, CWE and KEV: how they fit together

  • CVE names the specific vulnerability.
  • CVSS rates how severe it is.
  • CWE (Common Weakness Enumeration) describes the type of weakness, such as out-of-bounds write or SQL injection.
  • EPSS estimates how likely exploitation is, and the CISA KEV catalog lists CVEs known to be exploited.

How to use CVE IDs in practice

  • Match CVE IDs from advisories against your asset inventory or software bill of materials (SBOM).
  • Search your scanner and ticketing system by CVE ID so one flaw is tracked once, not as many separate findings.
  • Check the vendor advisory linked from the CVE for the fixed version and any workaround before you patch.
  • Use the CVE ID, not the nickname, in tickets and reports. Names like Log4Shell are handy but not unique.

Where to go next

Learn how to turn CVE IDs into a patching order in our guide to prioritizing vulnerability patching with CVSS, EPSS and KEV. Every vulnerability story in our vulnerability coverage includes the CVE ID in the headline and links the vendor advisory.