What is CVE?

The CVE program is run by MITRE under sponsorship from CISA, with actual ID assignment delegated to a distributed network of CVE Numbering Authorities (CNAs), which includes major vendors (Microsoft, Google, Red Hat), security research firms, and MITRE itself for cases nobody else covers. A researcher or vendor requests an ID for a newly found flaw, MITRE or the relevant CNA reserves it, and once details are ready for public release the entry gets published with a description, affected products and versions, and references to advisories or patches. Importantly, a CVE ID by itself only identifies that a vulnerability exists and roughly what it affects; it says nothing about how severe it is or how likely it is to be exploited, which is why CVSS scoring exists as a companion, not a replacement.

The National Vulnerability Database (NVD), run by NIST, enriches raw CVE entries with CVSS scores, CWE (Common Weakness Enumeration) classification of the underlying flaw type, and affected-product data in a structured format tools can consume. Vulnerability scanners (Tenable Nessus, Qualys, Rapid7 InsightVM) match installed software versions against the CVE/NVD dataset to produce a scan report, and every patch management workflow ultimately traces back to a list of CVE IDs that need remediation. Vendor advisories reference CVE IDs directly, a Microsoft Patch Tuesday bulletin lists every CVE fixed that month, which lets defenders cross-reference a single ID against multiple sources: the vendor's own writeup, NVD's scoring, CISA's Known Exploited Vulnerabilities catalog if it's being actively used in attacks, and any public proof-of-concept exploit code.

Not every vulnerability gets a CVE quickly, and the backlog and assignment delays have been a recurring operational problem industry-wide, meaning a scanner or an analyst sometimes has to work from a vendor's own advisory before an official CVE ID and NVD enrichment catch up.