CVE (Common Vulnerabilities and Exposures) Reference
Reference for CVE identifiers, the NVD, and vulnerability lifecycle management.
CVE Identifier System
CVE IDs follow the format CVE-YEAR-NUMBER where NUMBER is an arbitrary-length integer. CVEs are assigned by CNAs (CVE Numbering Authorities) and published in the CVE List. Each CVE includes a description and references to affected products. The National Vulnerability Database (NVD) enriches CVEs with CVSS scores, CPE mappings, and CWE classifications. CVEs enable unambiguous vulnerability referencing across tools and advisories.
- format
- CVE-YEAR-NUMBER
- CNA
- Numbering Authority
- NVD
- Enriches CVEs
CVE-2024-12345assigns IDsCVSS, CPELifecycle and Usage
A CVE starts as RESERVED (ID assigned, details pending), becomes PUBLIC when published, then may be REJECTED if invalid. The CVE Record 4.0 format (JSON) provides richer structured data. CVSS scores in NVD quantify severity for prioritization. EPSS (Exploit Prediction Scoring System) estimates exploitation likelihood. KEV (Known Exploited Vulnerabilities) catalog lists CVEs being actively exploited. Dependency scanning tools match library versions to CVEs.
- states
- Reserved, Public, Rejected
- EPSS
- Exploitation likelihood
- KEV
- Known exploited
lifecycle0-1 scoreCISA catalog