What is CVE (Common Vulnerabilities and Exposures)?
A standardized public identifier for a specific security vulnerability, enabling consistent tracking, scoring, and patching across the industry.
Definition
A CVE is a unique identifier — like CVE-2021-44228, the Log4Shell flaw — assigned to a publicly disclosed vulnerability so vendors, scanners, and security teams all reference the same issue. The MITRE-run program coordinates assignment through CVE Numbering Authorities, and NIST's National Vulnerability Database enriches each entry with a CVSS severity score from 0 to 10. Dependency scanners such as Dependabot, Snyk, and Trivy match your libraries and container images against CVE feeds, turning disclosures into pull requests and build failures. Triage still requires judgment: a critical CVE in an unreachable code path may matter less than a medium one on your login route.