CVEID

CVEid, commonly written as a CVE ID, refers to the unique identifier assigned to each publicly known cybersecurity vulnerability within the Common Vulnerabilities and Exposures (CVE) system. A CVE ID follows the format CVE-YYYY-NNNN, where YYYY is the year and NNNN is a sequential number. This label is used across security advisories, vulnerability databases, ticketing systems, and risk-management tools to unambiguously reference a single vulnerability.

Management and assignment of CVE IDs are handled by MITRE in coordination with a network of CVE Numbering Authorities (CNAs). CNAs include security vendors, CERTs, academic institutions, and other organizations authorized to assign CVE IDs. When a vulnerability is reported, the CNA or MITRE assigns an unused CVE ID and creates a CVE entry containing a concise description, affected products, and references to advisories or patches. The process aims to identify duplicates and maintain a consistent, public record.

Contents of a CVE entry typically include a brief vulnerability description, affected products or platforms, and references to external advisories, patches, or vendor notes. While the CVE ID itself identifies the vulnerability, severity is usually conveyed through separate scoring systems such as the Common Vulnerability Scoring System (CVSS) and is often published in conjunction with the entry by databases like NVD.

Usage and scope: CVE IDs enable interoperability among vulnerability databases, scanners, and remediation workflows, helping organizations correlate and manage exposures across ecosystems. Not every disclosed vulnerability receives a CVE ID; some disclosures remain private or are outside the CVE program.

History and significance: The CVE program, administered by MITRE since the late 1990s, aims to standardize vulnerability identifiers. CVE IDs are publicly searchable through the MITRE CVE database and other repositories, ensuring a common reference point for researchers, vendors, and security teams. The term CVEid is commonly used informally to refer to the CVE ID itself.