CVE (Common Vulnerabilities and Exposures)

A CVE identifier is a unique public reference for a specific security vulnerability in a specific product, in the form CVE-year-number. Its purpose is coordination rather than analysis: it gives vendors, scanners, distributions and defenders one unambiguous name for the same flaw, so an advisory, a patch note and a scanner finding can be matched to each other without guessing. Each entry describes the affected versions and links to the vendor's advisory. A CVE is usually accompanied by a severity score, and this is where teams most often go wrong. A base score describes the vulnerability in the abstract — how it can be reached, what it grants — but not whether your deployment is exposed. A critical-rated flaw in a code path your application never calls, in a container with no network exposure, may matter less than a medium-rated one on your public edge. Triage therefore has to combine the score with reachability, exposure and the presence of exploitation in the wild, and a policy that requires patching by score alone reliably produces both alert fatigue and misplaced urgency. Operationally, CVEs are how dependency scanning works: a software bill of materials lists what you ship, a scanner matches those components and versions against published identifiers, and the lockfile is what makes the answer exact. The recurring failure is not the initial scan but the ongoing one — a dependency that was clean when it was added and has a published CVE eighteen months later, with nobody watching.