CVE

Definitions

1. Common Vulnerabilities and Exposures — a standardized identifier system maintained by MITRE for publicly known cybersecurity vulnerabilities, formatted as CVE-YEAR-NUMBER.

   In plain English: A universal ID number given to every known security bug so everyone in the industry can talk about the same problem using the same name.

   Example: "CVE-2021-44228 will forever be seared into the memory of anyone who was on-call during Log4Shell."

2. A CVE entry includes a severity score (CVSS, 0-10), affected software versions, and a description. CVE-2021-44228 (Log4Shell, CVSS 10.0) is a recent example that sent the entire industry scrambling — a single vulnerability in a ubiquitous Java logging library.

   Example: 'We got paged about CVE-2024-3094 — the XZ Utils backdoor. CVSS 10.0. Every Linux server in the fleet needed patching within hours.'

   Source: severity scoring / notable examples

Etymology

1999

MITRE launches the Common Vulnerabilities and Exposures system at the urging of the security community to standardize vulnerability naming

1999

The first CVE entry, CVE-1999-0001, documents an IP fragment reassembly bug — mundane but historic

2014

Heartbleed (CVE-2014-0160) becomes the first CVE to get its own logo and website, changing how the public perceives vulnerabilities

Related Terms

• Zero-Day
• Bug Bounty
• Responsible Disclosure
• Vulnerability Scanner
• Baseline Security
• Cold Storage
• Dead Drop
• Detection Signature
• Feature Abuse
• Identity Resolution
• Initial Access
• Operator Security
• Poison Pill
• Rich Text Attack