Glossary
What is a CVE? How the shared vulnerability ID system works
CVE assigns each vulnerability a unique ID (e.g. CVE-2025-12345) so everyone names the same vulnerability the same way. How to read it, how CVE / CVSS / KEV differ, and how indie developers realistically keep up with machine monitoring.
Numbers like "CVE-2021-44228" and "CVE-2017-5638" appear in every big breach story. Here's what they mean, and how an indie developer can realistically keep up.
How to read the number
A CVE id has three parts. The number itself carries no severity meaning (that's a separate thing).
Why it's needed
Vulnerabilities are found constantly. Without a shared name, "the vulnerability you mean" and "the one I fixed" might not be the same thing. A common ID lets news, patches, scanners, and databases all point at the exact same vulnerability. That's the starting point for any fix.
Who assigns the numbers
CVE is run by the CVE Program, operated by MITRE in the US and funded by the US CISA. The numbers themselves are assigned by organizations authorised as CNAs (CVE Numbering Authorities) around the world: software vendors, security research organizations, national CERTs and others, several hundred in total. In Japan, JPCERT/CC is one of them.
A CVE record has a state. "Reserved" means the number has been set aside but details are withheld; "Published" means the content is public; "Rejected" means it was withdrawn as a duplicate or error. When a number appears in the news with no details behind it, it may still be reserved.
CVE vs NVD vs JVN
The same CVE id shows different information depending on where you look it up.
| Name | Run by | What it contains | Use it for |
|---|---|---|---|
| CVE (cve.org) | MITRE (supported by CISA) | the id, a short description, references | the official id and summary |
| NVD | US NIST | CVE data plus CVSS scores and affected products | the score and which products are affected |
| JVN | JPCERT/CC and IPA | vulnerabilities in Japanese products, explanations and fixes in Japanese | Japanese-language detail, Japanese products |
| KEV | US CISA | CVEs confirmed as exploited, with remediation deadlines | prioritizing |
CVE vs CVSS vs KEV: what each one tells you
These three travel together but answer different questions. You use all three to prioritize.
| Term | Answers | Example |
|---|---|---|
| CVE | Which vulnerability (the name) | CVE-2021-44228 (Log4Shell) |
| CVSS | How severe (0–10) | 10.0 (worst class) |
| KEV | Is it being exploited? | On the exploited list → top priority |
A high CVSS isn't automatically top priority
The score is a "worst-case theoretical value". In practice, weigh KEV (is it being exploited right now) and whether you use the affected feature. A 10.0 you don't use has small impact; a mid-score under active exploitation is top priority.
From assignment to fix
A CVE isn't published the instant it's found — it goes through coordination.
Discovery & report
Reserved
Published
Exploited (KEV)
Examples: CVEs that keep showing up in the news
These are incidents covered on this site and their CVE ids. You don't need to memorize the numbers; the point is that searching by the number pulls together information about the same vulnerability from everywhere.
| CVE id | Common name / product | Related incident |
|---|---|---|
| CVE-2014-0160 | Heartbleed (OpenSSL) | Heartbleed: server memory leaked |
| CVE-2017-5638 | Apache Struts | Equifax: left unpatched, 147 million people's data exposed |
| CVE-2018-13379 | VPN appliance | Handa Hospital: reported as the ransomware entry point |
| CVE-2021-44228 | Log4Shell (Log4j) | Log4Shell: in use through indirect dependencies nobody noticed |
| CVE-2023-34362 | MOVEit Transfer | MOVEit: damage spread to more than 2,700 organizations |
| CVE-2024-3094 | XZ Utils | XZ Utils: a backdoor planted in the release files |
Once a number is published, attackers are reading the same information. In the Equifax and Handa Hospital incidents, there was time between the fix being released and the intrusion. The time until you apply the fix is the time you can be attacked.
A realistic way to keep up
Tracking every CVE by hand is impossible, and the miss becomes the incident. → A public CVSS 10.0 overlooked for months
So let machines watch.
Common mistakes
- Reading the news and judging "probably fine" by hand
- Measuring risk from
package.jsontext alone - "Update someday" with no deadline
Let machines watch
- Dependabot (GitHub): auto-PRs for CVEs matching your dependencies
- osv-scanner (Google): checks your lockfile in CI, one step
- Judge by the version actually running (not the floor)
The key is to judge by the version actually running — the package.json floor can differ from what is actually running (this misjudgment also fed an RCE incident).
How to check your own setup
Look up what a CVE id is about
Enter a number from the news into the CVE / KEV Lookup to see its CVSS score, exploit probability (EPSS) and whether it is on KEV in one place.
List the CVEs that hit your dependencies
Load your lockfile (package-lock.json, pnpm-lock.yaml and so on) into the Dependency Vulnerability Scanner to get a list of matching CVEs and GHSAs. For npm projects, npm audit does the same.
Match servers and appliances by product and version
For products outside your package manager, such as servers and VPN appliances, check the vendor's advisories to see whether the version you run is affected. If it is, set a deadline for updating (→ handling a CVE in practice).
Sources (primary)
- CVE Program, "Process" — cve.org (assignment by CNAs and CVE record states)
- NIST, "National Vulnerability Database" — nvd.nist.gov
- JPCERT/CC and IPA, "JVN (Japan Vulnerability Notes)" — jvn.jp
- CISA, "Known Exploited Vulnerabilities Catalog" — cisa.gov
Read next
- Glossary: What is CVSS (the severity rubric) · What is RCE
- Defense: Build a CVE-tracking routine
- In practice: deciding what to patch first (setting priority and deadlines)
FAQ
QHow do I read a CVE number?
It's 'CVE-year-sequence'. For example CVE-2025-12345 was assigned in 2025. The number itself carries no severity — severity is expressed separately by CVSS. The sequence is not fixed at four digits; it grows as needed.
QWhat's the difference between CVE, CVSS and KEV?
CVE is the name (which vulnerability), CVSS is the 0–10 severity score (how bad), and KEV is a list of vulnerabilities observed being exploited in the wild. For prioritization, weigh KEV (being attacked now) as heavily as a high CVSS.
QIsn't tracking every CVE impossible for one developer?
By hand, yes — and the misses become incidents. So let machines watch: Dependabot (GitHub) or osv-scanner auto-notifies you of CVEs that match your dependencies.
QWhat does CVE stand for?
Common Vulnerabilities and Exposures. It is the CVE Program, started in 1999, which gives publicly disclosed vulnerabilities a shared identifier. It is operated by the US non-profit MITRE and funded by the US Cybersecurity and Infrastructure Security Agency (CISA).
QWhat's the difference between CVE, NVD and JVN?
CVE is the list of identifiers with short descriptions. NVD is a database run by the US NIST that adds CVSS scores and affected-product data to each CVE. JVN is Japan's vulnerability portal, run by JPCERT/CC and IPA, covering Japanese products with explanations in Japanese. You can search all three by the same CVE id.
QAre there vulnerabilities without a CVE id?
Yes. Some are fixed without anyone requesting a CVE, some only carry a vendor's own advisory number, and some only have a GitHub advisory id (GHSA-...). No CVE is not proof of safety. For dependencies, tools like osv-scanner help because they match against several sources at once, including CVE and GHSA.