[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [CVE Explained: How Vulnerabilities Are Named and Scored](/blog/cve) Publish date July 28, 2026 {x} minute read # CVE Explained: How Vulnerabilities Are Named and Scored [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) [Common Vulnerabilities and Exposures](https://www.upguard.com/glossary?search=cve) (CVE) is a list of publicly disclosed [information security](https://www.upguard.com/blog/information-security) [vulnerabilities](https://www.upguard.com/blog/vulnerability) and exposures. CVE was launched in 1999 by the MITRE corporation to identify and categorize vulnerabilities in software and firmware. CVE provides a free dictionary for organizations to improve their [cyber security](https://www.upguard.com/blog/cyber-security). MITRE is a nonprofit that operates federally funded research and development centers in the United States. ## The Difference: Vulnerabilities vs. Exposures A [vulnerability](https://www.upguard.com/blog/vulnerability) is a weakness that can be [exploited](https://www.upguard.com/blog/exploit) in a [cyberattack](https://www.upguard.com/blog/cyber-attack) to gain unauthorized access to or perform unauthorized actions on a computer system. Vulnerabilities can allow attackers to run code, access system memory, install different [types of malware](https://www.upguard.com/blog/types-of-malware) and steal, destroy or modify [sensitive data](https://www.upguard.com/blog/sensitive-data). An Exposure is a mistake that gives an attacker access to a system or network. Exposures can lead to [data breaches](https://www.upguard.com/blog/data-breach), [data leaks](https://www.upguard.com/blog/data-leak), and [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii) being sold on the [dark web](https://www.upguard.com/blog/dark-web). In fact, some of the [biggest data breaches](https://www.upguard.com/blog/biggest-data-breaches) were caused by accidental exposures rather than sophisticated cyber attacks. ### What is the Goal of CVE? The goal of CVE is to make it easier to share information about known vulnerabilities so that cybersecurity strategies can be updated with the latest security flaws and security issue CVE does this by creating a standardized identifier for a given vulnerability or exposure. CVE identifiers (also called CVE names or CVE numbers) allow security professionals to access information about specific [cyber threats](https://www.upguard.com/blog/cyber-threat) across multiple information sources using the same common name. For example, [UpGuard](https://www.upguard.com/) is a CVE compatible product, and its reports reference CVE IDs. This allows you to find fix information on any CVE compatible vulnerability database. ## What is the Common Vulnerability Scoring System (CVSS)? The Common Vulnerability Scoring System (CVSS) is a set of open standards for assigning a number to a vulnerability to assess its severity. CVSS scores are used by the NVD, CERT, UpGuard and others to assess the impact of a vulnerability. A CVSS score ranges from 0.0 to 10.0. The higher the number the higher degree of security severity. ### Who Manages CVE? MITRE maintains the CVE dictionary and CVE website, as well as the CVE Compatibility Program. The CVE Compatibility Program promotes the use of standard CVE identifiers issued by authorized CVE numbering authorities (CNAs). ### Who Sponsors CVE? CVE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and US-CERT. ### What are the Benefits of referring to CVEs? The CVE database allows organizations to set a baseline for evaluating the coverage of their security tools. CVE's common identifiers allow organizations to see what each tool covers and how appropriate they are for your organization. Security advisories can reference CVE vulnerability information to search for known attack signatures and remediate [critical exploits](https://www.upguard.com/blog/apache-log4j-vulnerability) as part of any [digital forensics](https://www.upguard.com/blog/digital-forensics) process. Look for security tools with CVE compatibility rather than proprietary [vulnerability assessments](https://www.upguard.com/blog/vulnerability-assessment), it's a great way to reduce your organization's [cybersecurity risk](https://www.upguard.com/blog/cybersecurity-risk). ### Is CVE a Vulnerability Database? CVE isn't a vulnerability database. CVE is designed to allow vulnerability databases and other tools to be linked together. It also facilitates comparisons between security tools and services. Check out the [US National Vulnerability Database (NVD)](https://nvd.nist.gov/) that uses the CVE list identifiers and includes fix information, scoring and other information. ### Does the CVE Database List All Known Vulnerabilities and Exposures? CVE does not list all known vulnerabilities and exposures. The goal of CVE is to be comprehensive and it is. Given the scale of vulnerabilities and exposures, it's likely an impossible task for one system to contain everything. ### Can Anyone Use CVE? Yes, CVE is free to use and publicly accessible. CVE is designed to allow anyone to correlate data between different vulnerabilities, security tools, repositories and services. Anyone can search, download, copy, redistribute, reference and analyze CVE as long as they don't modify any information. ### What is a CVE Entry? A CVE entry describes a known vulnerability or exposure. Each CVE entry contains a standard identifier number with status indicator (i.e. "CVE-1999-0067", "CVE-2014-12345", "CVE-2016-7654321"), a brief description and references related vulnerability reports and advisories. Each CVE ID is formatted as CVE-YYYY-NNNNN. The YYYY portion is the year the CVE ID was assigned or the year the vulnerability was made public. Unlike vulnerability databases, CVE entries do not include risk, impact fix or other technical information. ## Can Hackers Use CVE to Attack My Organization? The short answer is yes but many cybersecurity professionals believe the benefits of CVE outweigh the risks: * CVE is restricted to publicly known vulnerabilities and exposures. * It improves the shareability of vulnerabilities and exposures within the cybersecurity community. * Organizations need to protect themselves and their networks by fixing all potential vulnerabilities and exposures while an attacker only needs to find a single vulnerability and exploit it to gain unauthorized access. This is why a list of known vulnerabilities is so valuable and an important part of [network security](https://www.upguard.com/blog/network-security). * The growing agreement for the cybersecurity community to share information is reducing the [attack vector](https://www.upguard.com/blog/attack-vector) of many cyber attacks. This is reflected in widespread acceptance that the CVE Board and CVE Numbering Authorities (CNAs) are key organizations in cybersecurity. As a concrete example, many believe the [ransomware](https://www.upguard.com/blog/ransomware) [WannaCry](https://www.upguard.com/blog/wannacry), which spread through the EternalBlue vulnerability, would have had less impact if the vulnerability was publicly shared. ## What is the CVE Board? The CVE Board is comprised of cybersecurity organizations including security tool vendors, academia, research institutions, government departments and agencies,  security experts and end-users of vulnerability information. The CVE Board provides critical input regarding data sources, product coverage, coverage goals, operating structure and strategic direction of the CVE program. All CVE Board discussions can be found via their [email discussion archives](https://cve.mitre.org/community/board/archive.html#board_mail_list_archive) and [meeting archives](https://cve.mitre.org/community/board/archive.html#meeting_summaries). The [CVE Board Character](https://cve.mitre.org/community/board/charter.html) is also publicly accessible. ## What are CNAs? CVE Numbering Authorities (CNAs) are organizations that identify and distribute CVE id numbers to researchers and vendors for inclusion in public announcements of new vulnerabilities. [CNAs](https://cve.mitre.org/cve/cna.html) include software vendors, open source projects, coordination centers, bug bounty service providers and research groups. CNAs are a federated systems that helps identify vulnerabilities and assigns them an ID without directly involving MITRE which is the primary CNA. ### Who are CNAs? There are currently 104 CNAs in 18 countries including many household names like [Microsoft](https://www.upguard.com/security-report/microsoft), [Adobe](https://www.upguard.com/security-report/adobe), Apple, [Cisco](https://www.upguard.com/security-report/cisco), Google, Hewlett Packard Enterprise, Huawei, [IBM](https://www.upguard.com/security-report/ibm), [Intel](https://www.upguard.com/security-report/intel), Mozilla, [Oracle](https://www.upguard.com/security-report/oracle), Red Hat, Siemens, [Symantec](https://www.upguard.com/security-report/symantec), VMWare, Atlassian, [Autodesk](https://www.upguard.com/security-report/autodesk), Cloudflare, Elastic, [GitHub](https://www.upguard.com/blog/bitbucket-vs-github), Kubernetes, [Netflix](https://www.upguard.com/security-report/netflix) and [Salesforce](https://www.upguard.com/security-report/salesforce). You can see the [full list of CVE numbering authorities here](https://cve.mitre.org/cve/cna.html). ### What is a Root CNA? MITRE serves as the primary CNA while root CNAs cover a certain area or niche. In many cases, a root CNA is when a major company - like Apple - posts vulnerabilities about its own products. In other cases, the root CNA may be focused on open source vulnerabilities. ## Where is the Latest Version of the CVE list? The latest version of the CVE list can always be found on [cve.mitre.org](https://cve.mitre.org/). While the CVE list is free, it can be hard to know which vulnerabilities affect your organization without additional tools. This is why many organizations now use tools that monitor for changes in the CVE list that affect them. ### How is a Vulnerability or Exposure Added to CVE? CVEs are added when a researcher finds a flaw or design oversight in software or firmware. The vendor does not have to see it as a vulnerability for it to be listed as a CVE. That said, the researcher may be required to provide evidence of how it could be used as part of an exploit. The stronger the claim, the more likely it will be added to CVE and the more likely it will have a high Common Vulnerability Scoring System score in vulnerability databases.   Potential CVEs reported by established vendors or other trusted parties will generally be added to the CVE list quickly. ### Where to Learn More About CVEs For an exhaustive list of answers to your CVE related questions, we recommend reading the [CVE's Frequently Asked Questions](https://cve.mitre.org/about/faqs.html). eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)