# CVE (Common Vulnerabilities and Exposures)

> A public identifier assigned to a specific, disclosed software vulnerability.

**CVE** is the public catalog of disclosed software vulnerabilities. Each entry gets a unique identifier — `CVE-2024-3094`, for example — that unambiguously names one specific flaw in one specific piece of software. The program is operated by the MITRE Corporation, a US non-profit that runs federally funded research centers, under the sponsorship of **CISA** (the Cybersecurity and Infrastructure Security Agency, the civilian cyber-defense agency of the US government). Identifiers are issued by CVE Numbering Authorities, a role many large vendors hold for their own products.

The identifier's value is that it is a shared name. A vulnerability scanner, a vendor advisory, a distribution's security tracker, and an SBOM can all refer to the same flaw and be understood to mean the same thing.

A CVE record describes the flaw, not how bad it is for you. Severity is scored separately, usually with **CVSS** (the Common Vulnerability Scoring System), which produces a 0–10 rating. A CVSS base score reflects the vulnerability in the abstract — not whether the affected code is reachable in your configuration. A critical CVE in a package you have installed but never execute is a different problem from the same CVE in your front door.

For virtual machine images, CVE scanning is normally performed against the package inventory of the built image — effectively, by cross-referencing an [SBOM](https://primcoat.app/glossary/sbom) against vulnerability databases. A hardened image is not a patched image: [CIS](https://primcoat.app/glossary/cis-benchmark) and [STIG](https://primcoat.app/glossary/disa-stig) hardening changes configuration, and does nothing about a vulnerable package version.

## Related

- https://primcoat.app/glossary/sbom.md
- https://primcoat.app/glossary/golden-image.md
- https://primcoat.app/glossary/cis-benchmark.md

---

Source: https://primcoat.app/glossary/cve
Primcoat — a managed VM image factory. https://primcoat.app