CVE

CVE stands for Common Vulnerabilities and Exposures. A CVE is a unique identifier, such as CVE-2024-3094, assigned to one publicly disclosed security vulnerability, with a short record describing it. The CVE Program issues the IDs through hundreds of CVE Numbering Authorities. A CVE says which vulnerability it is; it does not say how severe it is or how to fix it.

What a CVE ID looks like

A CVE ID has the form CVE-YYYY-NNNN: the prefix, a year and a sequence number of four or more digits. CVE-2021-44228 is Log4Shell in Apache Log4j; CVE-2024-3094 is the backdoor in the xz compression library.

The year is the year the ID was reserved or the vulnerability was made public, not necessarily the year it was found or fixed. An ID reserved in December and published in February keeps the earlier year, which is why a "2025" CVE can appear in 2026.

Who assigns CVE IDs

The CVE Program was founded in 1999. It is sponsored by the US Cybersecurity and Infrastructure Security Agency (CISA), operated by MITRE as its Secretariat and governed by a CVE Board.

IDs are assigned by CVE Numbering Authorities (CNAs): software vendors, open source projects, CERTs, bug bounty platforms and research firms, each for an agreed scope, typically its own products. Microsoft assigns IDs for Microsoft products, the Linux kernel project for the kernel, GitHub for projects that report through GitHub. The CVE partner list has more than 500 organizations. Roots and Top-Level Roots (MITRE and CISA) recruit and oversee CNAs, and a CNA of Last Resort takes reports no other CNA covers. Authorized Data Publishers (ADPs) add information to records published by others; CISA's ADP adds data such as SSVC decision points and KEV status.

If you need an ID for a vulnerability in your own product, see CVE IDs and CNAs.

The life of a CVE record

1. A vulnerability is found and reported to the vendor or to a CNA.
2. The CNA reserves an ID, often while the vulnerability is still under embargo and before a fix exists.
3. The CNA publishes the record: a description, the affected products and versions, and references. It can add a CVSS score and a CWE.
4. Others enrich it: ADPs add data to the record, and downstream databases such as the NVD, the EUVD and Linux distributions add their own scores, product names and fix status.
5. The record can be updated later, or rejected if it turns out to be a duplicate or not a vulnerability.

Records use the CVE JSON 5 format and are published in the cvelistV5 repository, which is the data behind our CVE publication trends.

CVE vs CVSS vs CWE vs NVD vs EUVD

Term	What it is	Run by	Example	Answers
CVE	ID and record for one vulnerability	CVE Program	CVE-2024-3094	Which vulnerability?
CVSS	Severity score from 0 to 10, a vector	FIRST	10.0 Critical	How bad, in general?
CWE	Catalog of weakness types	MITRE	CWE-79 (XSS)	What kind of mistake?
NVD	Database that enriches CVE records	NIST	CVSS, CWE, CPE	Which products, how severe?
EUVD	European Vulnerability Database	ENISA	EUVD-2025-4893	The EU's view of the same issue
GHSA	GitHub Security Advisories	GitHub	GHSA-hgfh-7qxq-x5c9	Which package versions?
OSV	Open format and database of advisories	OpenSSF, Google	Collects GHSA and others	Which package versions?

• CVSS (FIRST, version 4.0 since November 2023) measures severity, not risk. One CVE can carry several scores: one from the CNA, one from NVD, one from a distribution.
• CWE (cwe.mitre.org) classifies the mistake behind a vulnerability, such as cross-site scripting or an out-of-bounds write. Many CVEs share one CWE.
• The NVD is not the CVE list. NIST's National Vulnerability Database takes published CVE records and adds analysis, including the CPE names that scanners use to match products. A CVE exists as soon as its CNA publishes it, whether or not NVD has enriched it.
• The EUVD is ENISA's database, operational since 13 May 2025 (ENISA). It gives each entry an EUVD ID and lists the CVE and GHSA IDs as aliases. ENISA has also been a CNA since January 2024. Under the CRA, fixed vulnerabilities notified through the Single Reporting Platform can later be disclosed in the EUVD.
• GHSA and OSV are keyed by ecosystem and package rather than by product, so they match the package URL of a component directly.

Two more signals sit on top of a CVE: whether it is being exploited (CISA KEV) and how likely exploitation is (EPSS). How teams combine them is covered in vulnerability prioritization.

Why the same CVE shows up many times in a scan

A scanner reports findings, not CVEs. One CVE becomes many findings when several components bundle the same library, when several products or images ship it, or when two tools report it under different IDs. "400 CVEs" in a report is often far fewer distinct vulnerabilities; see how to reduce vulnerability noise.

2025 and 2026: the funding scare and NVD changes

• April 2025. MITRE told the CVE Board that its contract to run the program would expire on April 16. CISA extended it overnight, by 11 months (The Record), and said it had been a contract administration issue rather than a funding one. CVE Board members announced the CVE Foundation, a non-profit meant to give the program independent governance. CVE records have been published without interruption since, through November 2026.
• May 2025. ENISA launched the EUVD, widely reported as a way for Europe to depend less on a single US-run program.
• NVD. In April 2025 NIST marked CVEs published before 2018 that were still awaiting enrichment as deferred. From 15 April 2026 it enriches only CVEs that meet priority criteria, with CISA KEV entries first, and labels the rest "Lowest Priority - not scheduled for immediate enrichment" (NIST). Tools that match only on NVD's CPE data now see more gaps; matching by package (OSV, GHSA, package URLs) depends less on NVD.

How many CVEs are published

The CVE Program published 39,718 records in 2024 and 47,801 in 2025, and the rate keeps rising. The current year's count, by week and by CNA, is on CVE publication trends; what that volume means for a small team is in vulnerability management automation. Recent cases with their own pages are under vulnerabilities.

CVEs and your software

Knowing which CVEs affect you starts with knowing which components and versions each build actually contains: see build-time SBOMs and are we affected by a CVE?. Fixing one is covered in CVE remediation, the ones without a fix yet in zero-day vulnerability, and the wider process in vulnerability management. A CVE describes a vulnerability, not an exploit: many CVEs are never exploited.

CRACI matches the components recorded in each build against published vulnerabilities and re-evaluates them as new CVEs appear.