CVE, NVD, CWE, CPE, KEV, EPSS: the acronyms, explained

Identifying a vulnerability

• CVE (Common Vulnerabilities and Exposures): the ID system. An ID looks like CVE-2024-12345: the year, then a sequence number of four or more digits. The year reflects when the ID was assigned, not necessarily when the flaw was found or introduced. A CVE ID by itself says nothing about severity or exploitation.
• CNA (CVE Numbering Authority): an organization authorized to assign CVE IDs, typically a vendor, a research group or a coordinator. The CVE Program is run by MITRE and sponsored by CISA.
• NVD (National Vulnerability Database): NIST's database built on CVE records. It adds analysis such as CVSS scores, CWE classification and affected-product data, and can lag behind the CVE record.

Describing it

• CWE (Common Weakness Enumeration): a catalog of weakness types such as out-of-bounds write or improper authentication. A CVE is a specific flaw in a specific product; a CWE is the category it belongs to.
• CPE (Common Platform Enumeration): a naming scheme for products and versions, used to say which software a CVE affects.

Scoring and prioritizing

• CVSS: severity, 0.0 to 10.0. See CVSS v3.1 vs v4.0.
• EPSS: probability of exploitation in the next 30 days. See what EPSS measures.
• KEV: CISA's catalog of vulnerabilities with evidence of active exploitation. See the CISA KEV catalog.
• SSVC (Stakeholder-Specific Vulnerability Categorization): a decision-tree method for turning exploitation status, impact and exposure into an action category.

Record states you will see

A CVE can be Reserved (ID allocated, no public details yet), Published, or Rejected (withdrawn, for example because it was a duplicate or not a vulnerability). Be careful with any article or tool that cites a CVE ID without checking the record: a plausible-looking ID can be reserved, rejected or simply wrong. Each CVE page on 0dayNews links to its source record.