CVE
Also called: vulnerability, CVE ID, known vulnerability
A CVE is a public identifier for a specific known security vulnerability, letting everyone refer to the same flaw unambiguously.
A CVE (Common Vulnerabilities and Exposures) identifier names one specific
vulnerability — CVE-2024-3094, say — so that vendors, scanners and advisories can refer
to the same flaw without ambiguity.
The severity score attached to it (CVSS) is a starting point, not a verdict. It rates the flaw in the abstract, not in your deployment. A critical CVE in a component you do not load is less urgent than a medium one on your network edge.
Better prioritisation signals: KEV (CISA’s catalogue of vulnerabilities actually being exploited) and EPSS (a probability that a given CVE will be exploited). Both cut a long list down to what is worth acting on this week.
Matching CVEs against an SBOM is what turns a feed of advisories into a list of things that affect you.