Glossary
CPE
Common Platform Enumeration
A standard naming scheme for software, operating systems and hardware, used to state which products a CVE affects.
Common Platform Enumeration is a standard naming scheme for IT products: applications, operating systems, hardware. The current specification is 2.3, and the official CPE dictionary is maintained by NIST.
A CPE 2.3 name reads cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other. The part field is a (application), o (operating system) or h (hardware), and * means "any value". Example: cpe:2.3:a:apache:http_server:2.4.62:*:*:*:*:*:*:*.
The NVD uses it to describe the products and version ranges a CVE affects (its "configurations"). The catch: until the NVD has analysed a CVE, it has no NVD CPE configuration, and a CPE search will not find it. cveo.tech therefore runs a CPE search and a keyword search together.
On cveo.tech
Related terms
- Awaiting Analysis (NVD)The NVD status of a CVE that is published but not yet enriched by NIST: no CPE, often no NVD score.
- NVDNIST's vulnerability database, which enriches each CVE with a CVSS score, a CWE and the affected products.
- CVEA unique public identifier assigned to a security vulnerability, in the form CVE-YEAR-NUMBER.