CVE
CVE · Common Vulnerabilities and Exposures · CVE ID · CVE record · CNA · NVD · EUVD
A unique public identifier given to a known vulnerability (for example CVE-2021-44228), so that everyone can talk about the same flaw without ambiguity.
In practice
The CVE Program, created in 1999, is operated by MITRE and funded by CISA, the US cybersecurity agency. Identifiers, in the format CVE-year-number, are assigned by CNAs (CVE Numbering Authorities): authorised vendors, researchers and CERTs. Each record briefly describes the flaw and the affected products; other databases enrich it, such as NIST’s NVD (CVSS score, CWE, affected versions) and, in Europe, the EUVD launched by ENISA in May 2025. A CVE alone does not tell you whether you are affected or how urgent it is: it has to be matched against your inventory, CVSS, EPSS and the KEV catalogue.
Real case: CVE-2021-44228, nicknamed Log4Shell, refers to the flaw in the Java library Log4j disclosed in December 2021. Rated 10 out of 10 on CVSS, it affected countless products; its single identifier allowed vendors, CERTs and scanning tools to coordinate fixes worldwide.
