CVE

CVE (Common Vulnerabilities and Exposures) is the program that gives publicly disclosed vulnerabilities a common name. Launched in 1999 by MITRE, it is funded by the US government through CISA. Each record ties an identifier to a description and references: vendor advisories, researcher write-ups, patches.

Identifiers are assigned by CNAs (CVE Numbering Authorities): vendors such as Microsoft or Cisco, national CERTs, bug bounty platforms, and MITRE as a last resort. The year in the identifier is the year it was assigned or reserved, not necessarily the year of disclosure; the number has at least four digits.

The CVSS score, the weakness category (CWE) and the list of affected products are supplied by the CNA when it knows them, then completed by the NVD. An identifier can also be rejected (duplicate, assignment error); it then stays visible with the REJECTED status.