CVE
Also known as Common Vulnerabilities and Exposures
A unique public identifier assigned to a specific known vulnerability.
The identifier lets everyone refer to the same issue unambiguously across vendors, scanners, and advisories. It is a catalogue entry rather than a severity rating.
Not every vulnerability receives one. Misconfigurations, weak passwords, and business logic flaws have no CVE, and those are frequently the findings that matter most in a test.
Where this comes up
CVE sits inside our penetration testing work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.
Related terms
CVSS A standard scoring system rating vulnerability severity from 0 to 10 based on exploitability and impact. CWE A classification of the underlying types of software weakness, describing categories rather than specific instances. Vulnerability A weakness in software, configuration, or process that an attacker could use to do something they should not be able to do. Patch management The ongoing process of finding, testing, and applying software updates across every system you run.