Home / Knowledge hub / CVE
Knowledge hub
CVE
A public reference number for one known flaw in one piece of software.
What it means
A CVE is a public reference number for one specific known vulnerability in one specific piece of software. When a report cites a CVE, it points at an entry anyone can look up and read for themselves.
NIST describes the list as a dictionary of common names for publicly known vulnerabilities. The number is an address, not a verdict. It lets two people be certain they mean the same flaw.
Why it matters
Precision is the whole point. A customer asking whether a named CVE affects you gets a version number back instead of an opinion. The details are public too, so the entry your engineers read is the entry anyone else can read. Attackers work from the same list, on the same day you do.
One measure matters more than the count. Every CVE becomes public on a date, and from that date anybody can compare it against the versions you run. The number worth tracking is how long you take from published entry to shipped fix, because that window is the part you control. Most teams have never measured it.
How it shows up
You meet CVEs mostly through your dependencies, where a tool matches the libraries you ship against known entries. Two cautions are worth carrying.
First, a CVE against a library you include does not prove you use the affected part, so judge it inside your application rather than in the abstract. Second, the list only covers published software. A bug in your own code has no number and never will, which is what application testing is for.
Questions people ask
CVE, answered
Who decides what gets a CVE number?
The CVE Program runs it, and authorised organisations called CNAs assign ids inside their own scope. Many software vendors are CNAs for their own products.
That is why a number can appear before a fix does, and why the quality of the description varies so much between one entry and the next.
A scanner found a CVE in one of our libraries. Are we actually vulnerable?
Not necessarily. The entry describes a flaw in a version of a package. Whether it reaches you depends on whether your code calls the affected function, whether user input gets there, and whether the path is reachable at all.
Judge each one against your application. A critical entry in a package you only use in a test helper is not the same risk as the same entry in your login code.
What is the difference between a CVE and a CVSS score?
The CVE names the flaw. The CVSS score rates how severe it is, out of ten, in the abstract.
One is an identifier and the other is a judgement, and the judgement can change while the identifier stays the same.
Do bugs in our own code get a CVE?
Not for a normal web application that you host and run yourself. CVE ids cover publicly known flaws in released software, so there is nothing for anyone else to look up.
If you ship a library, an agent or an on-premises product, then yes, and you may want to become a CNA for it.
A customer asked if we are affected by a named CVE. What do we tell them?
Give them three facts: whether you use the component at all, which version you run, and whether the affected code path is reachable in your product. Then give a date for the fix if one is needed.
That answer takes minutes when you hold a list of what you ship. It takes a week when you do not, which is the real argument for keeping one.
Related
Terms that sit next to this one
CWE
A catalogue of vulnerability types, rather than individual bugs.
CVSS
A scoring system that turns a vulnerability into a number out of ten.
Dependency vulnerability
A known flaw in a library your application ships.
Known-vulnerable component
A library or runtime with a published flaw that you are still shipping.
SCA
Checking your libraries against databases of published vulnerabilities.
Which CVEs do you actually ship?
We report known flaws against the version in your repository, with the path that reaches them, so your team fixes what applies instead of triaging a list. Ask for a $199 pilot.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.