How a CVE Gets Assigned?
The CVE Program is run by MITRE and sponsored by the US Cybersecurity and Infrastructure Security Agency (CISA). It does not issue every ID from one desk. Instead, it authorizes organizations called CVE Numbering Authorities (CNAs), around 365 of them as of 2025, to assign IDs within their own scope. A vendor like Microsoft, or an open-source project, reserves a block of IDs and issues one when a qualifying vulnerability is confirmed. The format is simple: the letters CVE, the year, and a serial number, as in CVE-2019-5786. This distributed model is how the program keeps pace with tens of thousands of new vulnerabilities a year without a single bottleneck.
What a CVE Record Contains?
A CVE entry is deliberately compact. It is a catalog card for a vulnerability, not a full research paper. Each published record includes the essentials you need to identify and act on the flaw:
- Identify the flaw with a unique CVE ID, the permanent name every tool and advisory can share.
- Describe the vulnerability in a short summary of what it is and how it is triggered.
- List the affected products and versions, so you know whether your software is in scope.
- Credit the assigning CNA and record the key dates, including when the ID was reserved and published.
- Reference external sources such as vendor advisories, patches, and proof-of-concept write-ups for deeper detail.
The Life of a CVE: Reserved, Assigned, Published
A CVE ID moves through stages. First it is reserved, meaning a CNA sets the number aside while a vulnerability is still being coordinated privately with the vendor. During this window the ID may appear in advisories with no details attached yet. Once the vulnerability is confirmed and ready for disclosure, the record is populated with its description, affected versions, and references, then published to the public CVE List. Shortly after, the National Vulnerability Database (NVD), run by NIST, ingests the record and enriches it with a CVSS score, product identifiers, and additional references. This is why you often see a CVE appear as a bare identifier first, then fill out with severity and detail a little later.
CVE vs CVSS, CWE, and KEV
CVE is easy to confuse with the acronyms that travel alongside it. Each answers a different question about a vulnerability, and using the right one keeps your prioritization clear.
| Term | What it is | Example |
|---|---|---|
| CVE | A unique identifier for one specific vulnerability | CVE-2024-1086 |
| CVSS | A severity score from 0.0 to 10.0 for that vulnerability | 7.8 (High) |
| CWE | The category of the underlying weakness type | CWE-416 (Use After Free) |
| KEV | CISA’s catalog of CVEs known to be exploited in the wild | Includes CVE-2024-1086 |
Why CVEs Matter for Your Security
A CVE turns a vague “there is a bug somewhere” into something you can track, search, and patch. When a scanner reports CVE-2024-1086 on your Linux host, you can look it up, check whether it appears on CISA’s Known Exploited Vulnerabilities catalog, and prioritize accordingly. Here is the catch: a CVE tells you a flaw exists and where, but not how urgent it is. Severity comes from a separate measure, the CVSS score, and real risk also depends on exposure and active exploitation. Treat the CVE as the name of the problem, then use scoring and context to decide what to fix first. For most teams, the practical workflow is straightforward: a scanner finds which CVEs apply to your software, the CVSS score and KEV status set the priority, and you patch from the top of that list down.
CVE names it, NVD scores itA CVE identifies a vulnerability; it does not rank it. The National Vulnerability Database enriches each CVE with a CVSS score, affected-version data, and references, so identification and prioritization come from two different sources working together.
Frequently Asked Questions
What does CVE stand for?
CVE stands for Common Vulnerabilities and Exposures. It is a program and a naming scheme that assigns one unique identifier to each publicly disclosed security vulnerability, so everyone refers to the same flaw by the same name.
What is the difference between a CVE and a CVSS score?
A CVE is the identifier that names a specific vulnerability. A CVSS score is a separate number from 0.0 to 10.0 that rates how severe that vulnerability is. One CVE has one identity; its CVSS score tells you how serious it is.
Who assigns CVE IDs?
CVE IDs are assigned by CVE Numbering Authorities (CNAs), organizations authorized by the MITRE-run, CISA-sponsored CVE Program. A CNA can be a software vendor, an open-source project, a coordination center, or a research group, and it issues IDs within its defined scope.
A website vulnerability scanner matches the software you run against known CVEs and tells you which ones apply to your assets, with the fix attached. Start a free scan and see which CVEs are exposed on your site right now.
