CVE (Common Vulnerabilities and Exposures) — Glossary

The longer version

Each publicly known flaw gets an ID in the form CVE-year-number, such as CVE-2021-44228. The ID lets vendors, researchers, scanners and defenders talk about the same flaw without confusion, even when each of them calls it something different. The program is run by MITRE and funded by CISA.

An ID is only a label. It does not say how bad the flaw is, whether it is being exploited or whether a fix exists. Those facts live in other places, such as the CVSS score, the vendor advisory and the CISA KEV catalog.

Log4Shell is the well-known example. The flaw in the Apache Log4j logging library was tracked as CVE-2021-44228, and every advisory, scanner rule and patch note from late 2021 pointed back to that one identifier.

Use CVE IDs as the key in your inventory and response notes, search advisories by ID and not by nickname, and check each ID against your own products and versions.

Where we use “CVE (Common Vulnerabilities and Exposures)”

CybersecurityExploits Overtake Stolen Passwords
Verizon's 2026 DBIR puts exploitation first at 31%, ahead of credential abuse at 13%. The rise is real, but a new category and a changed taxonomy make the gap look wider than it is.
Nov 1, 2026Key term
CybersecurityCISA Adds Exploited GitLab and Cisco Flaws
Two exploited flaws hit CISA's KEV catalog on 29 October, but upgrading GitLab to the 12 October builds still leaves a second CVSS 10.0 flaw open. Here's what to patch, and in what order.
Nov 1, 2026Key term
CybersecurityGlobalProtect CVE-2026-0257 and Ransomware
Palo Alto's GlobalProtect flaw CVE-2026-0257 went from an advisory on 13 May to ransomware intrusions by June. This timeline separates what the documents show from what sources only report or claim.
Nov 1, 2026Key term
CybersecurityMicrosoft's Record Patch Tuesday: What More Than 1,400 CVEs Actually Mean
Microsoft's October 2026 Patch Tuesday listed about 1,413 CVEs, roughly eight times the previous monthly record. Here is what the count measures, who found the flaws, and how to turn the list into a patch order.
Nov 1, 2026Key term
CybersecurityPatch by Exploitation, Not CVSS
Sorting a patch queue by CVSS puts actively exploited flaws behind thousands that nobody is using. Four yes-or-no questions adapted from CISA's new directive give a small team a faster order.
Nov 1, 2026Key term
CybersecurityCitrix and Ivanti Edge Zero-Days: What to Patch Now
Citrix NetScaler and Ivanti Connect Secure were exploited before fixes existed, and NetScaler's 4 October fix builds are still affected by a later SAML flaw on appliances acting as an identity provider. Here are the builds to move to by 6 November and how to check for compromise.
Nov 1, 2026

The longer version

Where we use “CVE (Common Vulnerabilities and Exposures)”

Get the Core in your inbox.