CVECommon Vulnerabilities and Exposures
Definition
Unique identifier in the form CVE-YYYY-NNNN, assigned by MITRE to a publicly disclosed vulnerability. Industry standard for referencing specific security flaws.
When a researcher or vendor reports a new vulnerability, MITRE (or a delegated CNA — Microsoft, GitHub, Google, etc.) assigns a CVE identifier. That ID travels with the vulnerability through NVD (NIST's database), vendor advisories, exploit databases, and news.
The CVE-YYYY-NNNN structure is predictable: YYYY is the assignment year (not necessarily discovery or disclosure year), NNNN is a sequential number. Since 2014 NNNN can have more than 4 digits.
A CVE itself doesn't include severity — that comes from CVSS. It doesn't include an exploit either. It's just the stable handle that lets every team talk about the same thing: 'CVE-2026-31635' is unambiguous; 'that Linux kernel bug' isn't.