CVE

CVE is the public catalog of disclosed software vulnerabilities. Each entry gets a unique identifier — CVE-2024-3094, for example — that unambiguously names one specific flaw in one specific piece of software. The program is operated by the MITRE Corporation, a US non-profit that runs federally funded research centers, under the sponsorship of CISA (the Cybersecurity and Infrastructure Security Agency, the civilian cyber-defense agency of the US government). Identifiers are issued by CVE Numbering Authorities, a role many large vendors hold for their own products.

The identifier’s value is that it is a shared name. A vulnerability scanner, a vendor advisory, a distribution’s security tracker, and an SBOM can all refer to the same flaw and be understood to mean the same thing.

A CVE record describes the flaw, not how bad it is for you. Severity is scored separately, usually with CVSS (the Common Vulnerability Scoring System), which produces a 0–10 rating. A CVSS base score reflects the vulnerability in the abstract — not whether the affected code is reachable in your configuration. A critical CVE in a package you have installed but never execute is a different problem from the same CVE in your front door.

For virtual machine images, CVE scanning is normally performed against the package inventory of the built image — effectively, by cross-referencing an SBOM against vulnerability databases. A hardened image is not a patched image: CIS and STIG hardening changes configuration, and does nothing about a vulnerable package version.