How CVE identifiers are assigned

CVE IDs are issued by CVE Numbering Authorities (CNAs). These include software vendors, open source projects, security researchers' organisations and national CERTs, each authorised to assign IDs within its own scope. When a vulnerability is confirmed, the CNA reserves an ID, and once the issue is public a CVE record is published with a short description and references such as the vendor advisory.

A CVE ID on its own does not say how severe a vulnerability is. Severity is usually expressed with a CVSS score, and details such as affected versions and fixes come from vendor advisories and databases like the US National Vulnerability Database (NVD).

Reading a CVE ID

In CVE-2021-44228, the year shows when the ID was assigned or the vulnerability was made public, and the sequence number identifies the specific record. That example is Log4Shell, the remote code execution flaw in Apache Log4j disclosed in December 2021.

Why CVEs matter

  • Security tools, vendors and teams can refer to exactly the same issue.
  • Scanners map findings to CVE IDs so you can look up fixes and exploit status.
  • Lists of exploited vulnerabilities, such as the CISA KEV catalogue, use CVE IDs to tell you which flaws attackers are actually using.

How DarkInvader helps

DarkInvader's Vulnerability Scanning maps findings on your internet-facing assets to CVE identifiers, adds severity and exploitation context, and highlights CVEs that are being actively exploited so they can be fixed first.

Explore Vulnerability Scanning

Frequently asked questions

Who runs the CVE Program?

The CVE Program is operated by MITRE and sponsored by the US Cybersecurity and Infrastructure Security Agency (CISA). IDs are assigned by a global network of CVE Numbering Authorities.

Does every vulnerability get a CVE?

No. CVEs cover publicly disclosed vulnerabilities in products within a CNA's scope. Issues in custom-built applications, misconfigurations and many cloud service flaws do not usually receive CVE IDs.

What is the difference between CVE and CVSS?

A CVE is the name of a specific vulnerability. CVSS is a scoring system that rates how severe a vulnerability is on a scale from 0 to 10. A CVE record often has a CVSS score attached.

Related terms and reading

Sources