Glossary
CVE (Common Vulnerabilities and Exposures)
The program and identifier scheme that gives each publicly disclosed vulnerability a unique ID such as CVE-2021-44228.
Common Vulnerabilities and Exposures (CVE) is the program that assigns unique identifiers to publicly disclosed vulnerabilities. It is operated by MITRE with sponsorship from CISA, and identifiers are issued by a federated network of CVE Numbering Authorities (CNAs) — vendors, researchers and coordinators — that also publish the initial description.
A CVE ID is a name, not an assessment. Severity scores, affected product data (CPE) and weakness types (CWE) are added by the CNA, by NIST's National Vulnerability Database (NVD), or by other enrichment programs such as CISA's Vulnrichment.
For a VOC, the CVE ID is the key that joins scanner findings with threat data like KEV and EPSS. Not every issue has one: misconfigurations and end-of-life software need their own identifiers and rules. See remediation workflow and ticketing.