CVE

in English: Common Vulnerabilities and Exposures

advancedwidespread

The CVE is the international registry of publicly known cybersecurity vulnerabilities, where each flaw receives a unique identifier so everyone refers to the same issue.

In plain terms

Imagine car manufacturers keeping a recall list: every factory defect has a serial number, and the mechanic, dealer, and owner all refer to it. CVE is the same in computing. Every publicly known security flaw gets an identifier, for example CVE-2021-44228: the year shows when the identifier was assigned, followed by a serial number.

It provides a common language. Without an identifier, one company would call the flaw "the logging bug" while another would call it "Log4Shell," and no one could be sure which one a released patch addresses. With the CVE number, the vendor, the antivirus maker, the system administrator and the journalist all point to the same flaw.

The CVE does not fix the bug or defend against it: it is merely a registry. It states that the bug exists and what it affects. The severity and required actions are provided by other systems and manufacturer announcements.

In the AI era, this list is increasingly referenced because coding agents and security AI tools check it to see if a program contains a known vulnerability. Meanwhile, the AI tools themselves receive CVE numbers if a flaw is found in them.

How it works

Someone (a researcher, manufacturer, or increasingly an AI agent) finds a vulnerability in software and reports it.
An authorized organization, the so-called CNA (typically the manufacturer itself or a security company), reserves a CVE identifier for the vulnerability.
A brief description of the flaw, the affected products and versions, and references are added to the public register, usually once a fix is also ready.
The severity score (CVSS) is often already provided by the organization assigning the identifier. Other databases, such as the US NVD, supplement the entry with further details, but the NVD has struggled with significant delays since 2024.
Security software and coding agents compare this data with programs running on your machine or within your company and alert you if an update is needed.

An everyday example

Your phone requests an update, and the description reads: "security fixes: CVE-2026-…". This means the manufacturer patched a publicly recorded vulnerability. Anyone can look up what the issue was based on the number.

Who is affected

developerScanning tools and coding agents flag known vulnerabilities in the external packages built into your program by their CVE numbers, and it is up to you to decide what to update. → Code

entrepreneur, executiveThe risk to your company's systems and the urgency of updates are often measured based on CVEs, and security regulations and audits also reference them.

everyoneIf you hear about a bug mentioned by a CVE number in the news, it often affects your phone, router, or browser as well, and updating is your responsibility.

A common misconception

MythIf a piece of software has no CVE, it is secure.

In realityThe list contains only reported and publicly disclosed bugs. Vulnerabilities that have not yet been discovered or are kept secret (such as zero-day vulnerabilities) are not included.

Limits and risks

A CVE number alone does not reveal how dangerous a flaw is: a barely exploitable minor issue and a global emergency receive identically formatted identifiers.
The quality and freshness of entries are uneven. Tens of thousands of new items are created annually, and detailed analysis is often delayed by months.
The system's operation largely depends on a single US government funding contract. This nearly expired in April 2025, causing significant uncertainty.
Specific weaknesses of AI systems, such as the insertion of deceptive instructions, are difficult to fit into the traditional CVE framework designed for software bugs.

Similar, but not the same

CVSS – The CVE identifies the bug, while the CVSS is a score from 0 to 10 estimating its severity.
CWE – The CWE is a catalog of error types (for example, "missing input validation"), while the CVE refers to a specific flaw in a specific product.
zero-day vulnerability – A zero-day vulnerability is a flaw unknown to the manufacturer or for which no fix exists yet, while attackers can already exploit it. Such flaws often lack a CVE number initially but usually receive one later.

Related concepts

Broader

Cybersecurity, Vulnerability management

Narrower

CVE identifier, CNA (numbering authority)

On the edge

CVSS, CWE, zero-day vulnerability, security update, software supply chain

A brief history

The CVE list was launched in 1999 by MITRE, a US non-profit research organization, so that different security tools and vendors could refer to the same vulnerability in a uniform way. The program is funded by the US government, currently through the cybersecurity agency CISA. The contract nearly expired in April 2025, but CISA extended it at the last moment.

Where things stand

The CVE remains the globally used reference standard for vulnerabilities at the end of 2026. Parallel solutions operate alongside it: the EU's own database, EUVD, launched in 2025 (based on EU law, the NIS2 Directive), while 2025 funding uncertainty sparked independent initiatives, such as the CVE Foundation. The growing number of bugs found by AI agents increasingly strains the system.

Status: 2026 November

In the news

Appears in 2 Agent Age stories; the curve shows weekly occurrence in the news magazine.

Critical sandbox escape found in DeepSeek's open-source coding agent Harness (CVE-2026-82533)Sep 8, 2026 · Code
AI slop pollutes the CVE pipeline with fake SQLite vulnerabilitiesAug 3, 2026 · Code

Also known as

CVE · CVE identifier · CVE number · CVE ID · CVE entry · Common Vulnerabilities and Exposures · common vulnerabilities and exposures · CVE-lista

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.