Understanding CVEs and CVSS Scores

CVE: the identifier

The Common Vulnerabilities and Exposures (CVE) program assigns IDs like CVE-2026-12345 so everyone can refer to the same flaw. IDs are issued by CVE Numbering Authorities (vendors, research organisations and others). A CVE record has a description and references; scoring is added by others.

NVD, CWE and KEV

• NVD (NIST National Vulnerability Database) enriches CVEs with scores, affected products (CPE) and references.
• CWE classifies the type of weakness (for example CWE-79 cross-site scripting).
• KEV is CISA's catalogue of vulnerabilities known to be exploited in the wild. Browse ours in the vulnerability database and the threat intelligence page.

CVSS: the score

The Common Vulnerability Scoring System (maintained by FIRST) produces a base score from 0.0 to 10.0:

A vector summarises the inputs, for example CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: Attack Vector Network, Attack Complexity Low, no privileges, no user interaction, scope unchanged, high impact on confidentiality, integrity and availability. CVSS v4.0 adds additional metric groups (threat and supplemental metrics).

What the score does not tell you

• Whether anyone is actually exploiting it — check KEV and exploit evidence (FIRST's EPSS estimates exploitation probability).
• Whether the vulnerable component is exposed in your environment.
• Missing scores: new CVEs may be "awaiting analysis"; never assume "no score" means "safe". Our pages label this explicitly.

A simple triage order

1. Is it in KEV or known to be exploited?
2. Is the product present and reachable in your estate?
3. How severe is the impact if exploited?
4. Is a patch or mitigation available?

Next: how to read a security advisory.