Also known as: Common Vulnerabilities and Exposures · CVE ID · CVE identifier
CVE (Common Vulnerabilities and Exposures) is a public catalogue that assigns a unique identifier, such as CVE-2026-31337, to each publicly disclosed software vulnerability so that everyone can refer to the same flaw unambiguously.
A CVE ID is a name, not a severity rating and not a guarantee that a flaw is exploitable. The identifier exists so that a vendor advisory, a scanner finding, a news article, and a patch note can all be confirmed to describe the same issue. Severity is layered on separately, most commonly via CVSS.
CVE IDs are issued by CVE Numbering Authorities (CNAs) — a distributed set of vendors and research organisations authorised to assign identifiers within their own scope. That distribution is why quality varies: some CNAs write precise, well-scoped records, others assign IDs generously to low-impact issues.
CVE-2026-31337 follows the standard format: the CVE prefix, the year the identifier was reserved (not necessarily the year of disclosure), and an arbitrary sequence number.
CVSS
CVSS (Common Vulnerability Scoring System) is an open standard that scores the technical severity of a vulnerability from 0.0 to 10.0, based on factors such as attack complexity, required privileges, and impact on confidentiality, integrity, and availability.
NVD
The NVD (National Vulnerability Database) is the US government repository, maintained by NIST, that enriches published CVE records with CVSS severity scores, affected product identifiers, and references.
Zero-Day
A zero-day is a software vulnerability that attackers know about and exploit before the vendor has released a patch, leaving defenders zero days to prepare a fix.
N-Day
An n-day is a vulnerability that has already been publicly disclosed and patched, but remains exploitable on systems that have not yet applied the update.
Vulnerability Management
Vulnerability management is the ongoing process of identifying, prioritising, remediating, and verifying fixes for security weaknesses across an organisation's systems and software.