Also known as: Common Platform Enumeration
CPE (Common Platform Enumeration) is a structured naming scheme for identifying software, hardware, and operating systems in a machine-readable way, used to state precisely which products and versions a vulnerability affects.
A CPE string looks like cpe:2.3:a:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other. It exists so that a vulnerability record can be matched automatically against an asset inventory without fuzzy string comparison of product names.
In practice CPE matching is notoriously imprecise. Vendors name products inconsistently across releases, version ranges are expressed through complex nested configurations, and many CVEs carry incomplete CPE data — which is why automated scanners produce both false positives and blind spots.
NVD
The NVD (National Vulnerability Database) is the US government repository, maintained by NIST, that enriches published CVE records with CVSS severity scores, affected product identifiers, and references.
CVE
CVE (Common Vulnerabilities and Exposures) is a public catalogue that assigns a unique identifier, such as CVE-2026-31337, to each publicly disclosed software vulnerability so that everyone can refer to the same flaw unambiguously.
SBOM
An SBOM (Software Bill of Materials) is a formal, machine-readable inventory of every component and dependency contained in a piece of software, including version numbers and licence information.
Vulnerability Management
Vulnerability management is the ongoing process of identifying, prioritising, remediating, and verifying fixes for security weaknesses across an organisation's systems and software.