Skip to content

Glossary

The words of vulnerability management

What a CVE identifier is, how to read a CVSS vector, why a CVE can be missing from a product search, what the CISA KEV catalog adds. Short, sourced definitions.

  1. Awaiting Analysis (NVD)

    The NVD status of a CVE that is published but not yet enriched by NIST: no CPE, often no NVD score.

  2. CISA KEV

    Known Exploited Vulnerabilities

    CISA's catalog of vulnerabilities with confirmed active exploitation.

  3. CPE

    Common Platform Enumeration

    A standard naming scheme for software, operating systems and hardware, used to state which products a CVE affects.

  4. CVE

    Common Vulnerabilities and Exposures

    A unique public identifier assigned to a security vulnerability, in the form CVE-YEAR-NUMBER.

  5. CVSS

    Common Vulnerability Scoring System

    A scoring system for the severity of a vulnerability, from 0.0 to 10.0, maintained by FIRST.

  6. CVSS vector

    The text string that spells out, metric by metric, how a CVSS score was obtained.

  7. CWE

    Common Weakness Enumeration

    A list of software and hardware weakness types: the category of mistake behind a CVE.

  8. EPSS

    Exploit Prediction Scoring System

    The probability, from 0 to 1, that a CVE will be exploited in the next 30 days, published by FIRST.

  9. NVD

    National Vulnerability Database

    NIST's vulnerability database, which enriches each CVE with a CVSS score, a CWE and the affected products.

  10. Zero-day

    A vulnerability exploited or made public before the vendor has released a fix.

Put them to use: the latest CISA KEV additions, this week's critical CVEs and recent CVEs.