What is a CVE? How to read, search and act on vulnerability IDs

A CVE identifier is a name, not a verdict. It exists so that two people discussing the same flaw can be certain they mean the same flaw — nothing more. Most confusion about CVEs comes from expecting the identifier to tell you how dangerous something is, which it was never designed to do.

How to read a CVE identifier

The format is fixed: CVE-YYYY-NNNN. The year is when the identifier was reserved, not when the flaw was found or disclosed — so a bug published in 2024 may well carry a 2023 identifier. The sequence number has no meaning and no upper bound; it simply grows.

Take CVE-2021-44228, the Log4j flaw known as Log4Shell. The identifier tells you nothing except that it is a distinct, catalogued issue reserved in 2021. Everything that made it a crisis — trivial remote exploitation, a library embedded in thousands of products — lives in the records attached to that name, not in the name itself.

Who assigns them

Identifiers are issued by CNAs (CVE Numbering Authorities), not by a central office. There are hundreds: Microsoft, Red Hat, Google, GitHub, Apache and many others assign identifiers for their own products, and MITRE acts as the CNA of last resort for everything else. This matters practically — a vendor CNA usually publishes the identifier at the moment it releases the fix, so the appearance of a CVE often coincides with a patch being available.

CVE, CVSS, CWE and KEV are four different things

These are routinely confused, and confusing them leads to bad prioritisation.

• CVE — the identifier. Answers "which flaw?"
• CVSS — a severity score from 0.0 to 10.0. Answers "how bad could this be, in the abstract?"
• CWE — the weakness class, such as CWE-79 for cross-site scripting. Answers "what kind of mistake was this?"
• KEV — CISA's Known Exploited Vulnerabilities catalogue. Answers "is this actually being exploited right now?"

CVSS is the one most often misused. It is a measure of theoretical impact under standard assumptions, and it takes no account of whether the affected component is reachable in your environment. A 9.8 in a library you ship but never call is less urgent than a 6.5 in an internet-facing login page.

Reading a CVSS vector

The headline number is a summary of a vector string, and the vector carries the information worth reading:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• AV:N — Attack Vector: Network. Reachable remotely.
• AC:L — Attack Complexity: Low. No special conditions required.
• PR:N — Privileges Required: None. No account needed.
• UI:N — User Interaction: None. Nobody has to click anything.
• S:C — Scope: Changed. Impact escapes the vulnerable component.
• C:H/I:H/A:H — High impact to confidentiality, integrity and availability.

That combination is what produces a 10.0, and it is the profile that deserves immediate attention. A vector reading AV:L/AC:H/PR:H/UI:R describes something requiring local access, difficult conditions, existing privileges and a cooperating user — rarely an emergency regardless of its score.

Where to look things up

• NVD (nvd.nist.gov) — the US National Vulnerability Database enriches CVE records with CVSS scores, CWE classification and affected-version data in CPE format.
• CISA KEV — a much shorter list of vulnerabilities with confirmed in-the-wild exploitation. If something appears here, ordinary patch cycles do not apply.
• The vendor advisory — usually more accurate than either about which configurations are actually affected.

Finding what you are exposed to

Scanning your own dependencies is more useful than reading vulnerability news. Most ecosystems have this built in:

# Node
npm audit --omit=dev

# Python
pip install pip-audit && pip-audit

# Debian/Ubuntu packages
apt list --upgradable 2>/dev/null

# Containers and filesystems, across ecosystems
trivy image myapp:latest
trivy fs .

These report CVE identifiers against the versions you actually run, which is the only view that lets you prioritise honestly.

A workable order of priority

1. On the KEV catalogue and reachable from the internet. Treat as an incident, not a ticket.
2. Reachable from the internet, no authentication, working exploit published. Patch within days.
3. High CVSS but not reachable — for example a flaw in a code path you never invoke. Schedule normally.
4. Anything requiring local access or existing privileges. Routine patching.

What a CVE does not tell you

It does not tell you whether you are affected: version ranges in the NVD are frequently wrong or over-broad, and the vendor advisory is the better source. It does not tell you whether a fix exists. It does not tell you whether anyone is exploiting it. And plenty of real vulnerabilities never receive an identifier at all — anything found and fixed internally usually has no CVE, so the absence of one proves nothing.