Common Vulnerabilities and Exposures (CVEs) is a public catalog of known cybersecurity issues in software solutions.
The CVE program was launched in September 1999 and is currently overseen by the MITRE Corporation. Each vulnerability is documented as a separate record in the CVE catalog and published by organizations that have partnered with the CVE program.
The CVE catalog can be accessed on the MITRE website and also via the National Vulnerability Database (NVD).
What is the Common Vulnerability Scoring System?
The Common Vulnerability Scoring System (CVSS) measures the severity of each vulnerability with a number ranging from 0.0 to 10.0.
The categories for each scoring range are as follows:
- 0.0 represents no risk
- 0.1 - 3.3 represents a low risk
- 4.0 - 6.9 represents medium risk
- 7.0 - 8.9 represents a high risk
- 9.0 - 10.0 represents a critical risk
What Qualifies as a CVE?
To qualify as a CVE, a vulnerability needs to meet three conditions:
- The vulnerability must only be associated with a single product.
- The impacted vendor must acknowledge the security vulnerability or the reporting party must prove its violation of the impacted vendor’s security policy.
- It must be possible to remediate the vulnerability independently from other software issues.
