Common Vulnerabilities and Exposures (CVE)

What is a CVE?

A CVE is a name for one vulnerability, plus a short public record about it. The name, a CVE ID such as CVE-2023-4966, is what lets a vendor advisory, a scanner result, a threat report and a patch ticket all point at the same flaw. The CVE Program is sponsored by CISA and operated by MITRE, but most records are written by the organizations closest to the code: vendors, open-source foundations, bug bounty platforms and national CERTs acting as CVE Numbering Authorities (CNAs). The program's public CNA list has more than 500 of them across more than 40 countries.

Volume has grown fast. The CVE Program's own metrics count 48,244 records published in 2025, and 35,872 in the first two quarters of 2026 alone.

How is a CVE ID formatted?

The format is CVE- plus a four-digit year plus a sequence number of four or more digits. The schema's pattern is CVE-[0-9]{4}-[0-9]{4,19}, so CVE-2024-0001 and CVE-2021-44228 are both valid, and five- or six-digit sequence numbers are normal.

The year is not a reliable "discovered on" date. CNA rule 4.2.19 says the year should reflect when the flaw was first publicly disclosed, when the record was first published, or when the ID was reserved, and a CNA may reserve an ID in one year and publish it the next. Citrix Bleed was reserved on September 14, 2023 and published on October 10, 2023; a 2025 ID published in 2026 is unremarkable.

What does a CVE record contain?

Records are JSON documents in the CVE Record Format (currently version 5.x). Here is an abridged copy of the real record for CVE-2023-4966, as returned by the CVE Services API. Some fields and array entries are left out; every value shown is as published.

{
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "cveMetadata": {
    "cveId": "CVE-2023-4966",
    "state": "PUBLISHED",
    "assignerShortName": "Citrix",
    "dateReserved": "2023-09-14T15:51:21.569Z",
    "datePublished": "2023-10-10T13:12:17.644Z"
  },
  "containers": {
    "cna": {
      "title": "Unauthenticated sensitive information disclosure",
      "affected": [
        {
          "vendor": "Citrix",
          "product": "NetScaler ADC",
          "defaultStatus": "unaffected",
          "versions": [
            { "version": "14.1", "lessThan": "8.50", "status": "affected", "versionType": "patch" }
          ]
        }
      ],
      "descriptions": [
        { "lang": "en", "value": "Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA  virtual server." }
      ],
      "problemTypes": [
        { "descriptions": [ { "type": "CWE", "cweId": "CWE-119" } ] }
      ],
      "metrics": [
        { "cvssV3_1": { "baseScore": 9.4, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L" } }
      ],
      "references": [
        { "url": "https://support.citrix.com/article/CTX579459" }
      ]
    },
    "adp": [
      { "title": "CISA ADP Vulnrichment", "providerMetadata": { "shortName": "CISA-ADP" } }
    ]
  }
}

What each part tells you:

• cveMetadata: the ID, its state, which CNA owns it, and the reserve and publish timestamps.
• cna container: the CNA's own statement. affected is the machine-readable part scanners should match on, with version ranges and a defaultStatus. problemTypes carries the CWE mapping, and metrics carries the CNA's CVSS vector if it supplied one.
• adp containers: enrichment added later by Authorized Data Publishers. For this record, CISA's ADP added an SSVC decision (exploitation "active", automatable "yes", technical impact "total") and a note that the CVE was added to the KEV catalog on October 18, 2023.

Descriptions are often brief. The affected versions and the vendor reference are usually the most useful fields for deciding whether you are exposed.

What are the record states?

A CVE ID moves through three states:

1. Reserved. A CNA has set the ID aside, typically during coordinated disclosure. The ID can appear in a vendor advisory before the record has any content; the program calls this "Reserved but Public".
2. Published. The CNA has filled in the data and published the record. It can still be updated.
3. Rejected. The ID should not be used. The record stays on the list so people can see it is invalid. CNA rules name the usual reasons: no vulnerability exists, the wrong ID was used, a duplicate assignment, or several IDs were merged into one. An unused reservation must also be rejected.

A rejected CVE in scanner output is a false positive by definition. Suppress it; don't patch for it.

CVE vs NVD vs CVSS vs CWE vs KEV

These get used interchangeably, and they answer different questions.

The NVD is a downstream database, not the source of CVE IDs. It historically added its own CVSS scores, CWE mappings and affected-product (CPE) data to every CVE. That changed on April 15, 2026, when NIST announced it would prioritize enrichment for CVEs in KEV, software used by the federal government, and critical software under Executive Order 14028. Other CVEs are still listed but labeled "Lowest Priority - not scheduled for immediate enrichment", CVEs backlogged from before March 1, 2026 moved to "Not Scheduled", and NIST no longer routinely adds its own severity score when the CNA already provided one. Practically: read the CNA's data in the CVE record first, and don't assume an NVD score or CPE list exists.

The 2025 funding scare

On April 15, 2025, a letter from MITRE vice president Yosry Barsoum warned that the contract funding MITRE's work on CVE and CWE would expire the next day. CISA executed an 11-month option period the night before the lapse, and a group of CVE Board members announced the CVE Foundation, a nonprofit meant to end the program's dependence on one government funder. In March 2026, CSO Online reported the CVE Board had been told in January there would be "no funding cliff in March", and CISA's acting director said the program was fully funded.

How practitioners use CVEs

• Check version ranges yourself. Scanners map packages to CVEs through the affected data or CPEs, and a mismatched range is worth catching before anyone patches.
• Prioritize with signals the record lacks. A CVE record tells you what and where. Whether to fix it this week comes from KEV status, the EPSS forecast, and whether the vulnerable code is exposed in your environment.
• Don't treat "no CVE" as "no vulnerability". CVEs cover disclosed flaws in distributed products. A broken authorization check in your own web app will never get one, which is why penetration testing and code review exist alongside CVE scanning.

Written by Parameter · Last reviewed September 27, 2026