CVE (Common Vulnerabilities and Exposures)

Monitoring and triage

Continuous monitoring and triage of newly published vulnerabilities is a foundational activity in an active cybersecurity program. CIS Critical Security Control 7, Continuous Vulnerability Management, calls for a plan to continuously assess and track vulnerabilities on all enterprise assets, to remediate them and minimize the window of opportunity for attackers, and to monitor public and private industry sources for new vulnerability information. A CVE ID is what connects those sources: a security advisory, a dependency scanner’s alert, and the patch that resolves it all refer to the same ID, which makes it the starting point for triage and remediation of known vulnerabilities in the software and components an organization runs.

CISA’s Known Exploited Vulnerabilities (KEV) catalog lists CVEs with reliable evidence of active exploitation. Under Binding Operational Directive 26-04, U.S. federal agencies can have as little as three days to remediate a vulnerability, depending on whether it is in the KEV catalog, whether the affected asset is publicly exposed, whether exploitation can be automated, and how much control it gives an attacker. Severity alone doesn’t set that clock; see CVSS for the difference between a vulnerability’s severity and its risk.

The CVE ID

A CVE ID has three parts: the CVE prefix, a year, and a sequence number of four or more digits, as in CVE-2019-0708 (BlueKeep). The year is when the ID was reserved or the vulnerability was made public, not when the vulnerability was discovered. There is no limit on the number of digits in the sequence number.

IDs are assigned by CVE Numbering Authorities (CNAs), organizations the CVE Program authorizes to assign IDs and publish CVE Records within a defined scope, such as their own products. A record starts out Reserved while the issue is coordinated privately, and is published once it has the minimum required details: a description, the affected products and versions, and at least one public reference.

What a CVE is not

A CVE ID names a vulnerability; it is not a severity rating. The CVE Program itself does not assign severity scores, but the CNA that publishes a CVE Record can include one, using the Common Vulnerability Scoring System (CVSS) scale from None to Critical. NIST’s National Vulnerability Database (NVD) is a separate service, synchronized with and based on the CVE List. Since April 15, 2026, the NVD prioritizes its own analysis for CVEs in the KEV catalog, in software used by the federal government, and in critical software as defined by Executive Order 14028; other CVEs are still added but marked “Lowest Priority - not scheduled for immediate enrichment,” and the NVD no longer routinely adds its own severity score when the CNA has supplied one.

Other identifiers: GHSA IDs

CVE is not the only naming system. The GitHub Advisory Database gives every advisory a GHSA ID in the format GHSA-xxxx-xxxx-xxxx, where each x is a letter or number from a restricted set. GitHub assigns a GHSA ID to advisories reported on GitHub and to those it imports from other sources, including the National Vulnerability Database and package ecosystem databases such as npm’s, and to every advisory type, including malware advisories about malicious open source packages. An advisory imported from the NVD links to its CVE Record, so a single vulnerability is often known by both a CVE ID and a GHSA ID. GitHub-reviewed advisories are mapped to specific packages and versions, and they are what Dependabot uses to alert repositories that depend on an affected package.

History

• January 1999: David E. Mann and Steven M. Christey of The MITRE Corporation presented the white paper “Towards a Common Enumeration of Vulnerabilities” at the 2nd Workshop on Research with Security Vulnerability Databases at Purdue University.
• September 1999: The CVE List launched publicly.
• 2002: NIST recommended CVE to U.S. federal agencies in SP 800-51, Use of the CVE Vulnerability Naming Scheme, which was updated in 2011.
• April 2025: The MITRE contract funding the program nearly lapsed; CISA extended it by executing the contract’s option period, as covered in The Imminent Funding Lapse of the CVE Database.

Sources

• Overview, CVE Program. Retrieved October 20, 2026.
• Process: CVE Record Lifecycle, CVE Program. Retrieved October 20, 2026.
• History, CVE Program. Retrieved October 20, 2026.
• CIS Critical Security Control 7: Continuous Vulnerability Management, Center for Internet Security, CIS Controls v8.1. Retrieved October 20, 2026.
• BOD 26-04: Prioritizing Security Updates Based on Risk, CISA. Retrieved October 20, 2026.
• NIST Updates NVD Operations to Address Record CVE Growth, NIST, April 15, 2026. Retrieved October 20, 2026.
• CVE program averts swift end after CISA executes 11-month contract extension, CSO Online, April 16, 2025. Retrieved October 20, 2026.
• Known Exploited Vulnerabilities Catalog, CISA. Retrieved October 20, 2026.
• About the GitHub Advisory Database, GitHub Docs. Retrieved October 20, 2026.
• Glossary: CVE Identifier, CVE Numbering Authority, CVE Record, CVE Program. Retrieved October 20, 2026.

Further reading

• CVE Explained, a Rietta site with plain-language coverage of CVEs, the NVD, and the vulnerability feeds that supplement them.