A CVE (Common Vulnerabilities and Exposures) is a unique, public identifier assigned to a specific known security vulnerability, in the format CVE-YYYY-NNNNN, so that everyone from vendors to defenders can refer to the same flaw unambiguously. The CVE Program is run by MITRE and sponsored by CISA, and a CVE ID like CVE-2026-60004 is essentially a catalog number: it names the vulnerability but does not, by itself, tell you how severe it is or whether it is being exploited.

Knowing what is a CVE is the entry point to vulnerability management, because almost every scanner, advisory, and patch note is organized around CVE IDs. When Gitea, Oracle, or Microsoft discloses a flaw, it gets a CVE, and that identifier becomes the key that links the vendor advisory, the severity score, the exploitation data, and the patch together.

Who assigns CVE IDs and how does the process work?

CVE IDs are issued by CNAs (CVE Numbering Authorities), which are organizations authorized by the CVE Program to assign identifiers within their scope. Many large vendors, including Microsoft, Oracle, and Red Hat, are CNAs and assign CVEs to flaws in their own products, while MITRE acts as the CNA of last resort. When a vulnerability is reported, a CNA reserves a CVE ID, and once details are published the entry becomes public with a description and references.

The CVE record itself is intentionally minimal: an ID, a description, and references. It does not include a severity score. That enrichment comes from the NVD (National Vulnerability Database), run by NIST, which analyzes published CVEs and adds a CVSS score, a CWE weakness type, and affected-product data.

How do CVE, NVD, CVSS, and KEV fit together?

These four are a stack, and confusing them is a common mistake. The CVE names the flaw, the NVD enriches it, CVSS rates its severity, and CISA KEV flags whether it is actually being exploited. You need all four to prioritize sensibly.

A practical example: Gitea CVE-2026-60004 was added to CISA KEV in August 2026 for active exploitation even before the NVD had assigned it a base score, showing that the CVE ID and the exploitation signal can matter well before the full NVD enrichment lands.

Why doesn't a CVE tell you how urgent a fix is?

Because a CVE is an identifier, not a risk assessment. Two CVEs can share the same CVSS score while one has a public exploit and internet exposure and the other does not. Roughly tens of thousands of new CVEs are published every year, far more than any team can patch at once, so the CVE list is a starting inventory, not a to-do list. Turning CVEs into action requires layering severity (CVSS), exploitation probability (EPSS), and confirmed exploitation (KEV) on top of the raw identifier.

Frequently asked questions

What does the CVE format mean? CVE-YYYY-NNNNN: the year the ID was reserved or published, followed by a sequential number with at least four digits.

Is every vulnerability given a CVE? No. CVEs cover publicly known vulnerabilities in products within a CNA's scope. Some issues, especially in bespoke or internal software, never receive one.

Where can I look up a CVE? The authoritative sources are cve.org (the CVE record) and the NVD (the enriched entry with CVSS), plus the vendor's own advisory.

Our read

A CVE is a shared vocabulary, and like any vocabulary it describes the world without prioritizing it. The trap is treating a scanner's CVE list as a plan; it is an inventory of what could be wrong, not proof of what is exposed in your environment. The verifiable-by-design move is to take the CVE, layer the exploitation data on top, then verify which of your actual assets expose it, rather than patching by identifier count. The number names the problem; verification tells you whether it is your problem.

Program structure per MITRE and NIST NVD; exploitation status per CISA KEV. Sources linked above.

Related: What is CVSS? and How to prioritize vulnerabilities.