What is a CVE?
A CVE is a public identifier for one specific security vulnerability, written as CVE-YEAR-NUMBER, for example CVE-2024-3094. It is assigned by a CVE Numbering Authority so that vendors, researchers and defenders can all refer to the same flaw unambiguously. A CVE identifier records that a vulnerability exists; it does not by itself say how severe or exploitable it is.
The value of a CVE is coordination, not analysis. Before the scheme existed, the same flaw might be called three different things by three vendors, and there was no reliable way to ask "are we affected by this one?" across products.
A CVE record names the affected product and versions, links to vendor advisories, and carries references to further analysis. Severity arrives separately, usually as a CVSS score, and real-world risk arrives later still, through evidence of exploitation.
The practical mistake is treating a CVE identifier as a to-do item. Tens of thousands are published each year, and only a small fraction are ever exploited against real organisations. Which ones matter is a prioritisation question, not an identification one.
Related coverage
CVE & Vulnerabilitiesdispatches →Newly disclosed CVEs, actively exploited vulnerabilities, and critical patches you need to apply now.