CVE, short for Common Vulnerabilities and Exposures, is the public catalogue that gives each disclosed security flaw in software or hardware a unique identifier, such as CVE-2026-109618. The identifier is a name, not an assessment. It exists so that a software vendor, a security scanner, a government agency and a website owner can be certain they are talking about the same bug. Before CVE, each vendor and database used its own label, and the same flaw could circulate under a dozen names.

The programme is run by the non-profit MITRE Corporation under contract to the US Cybersecurity and Infrastructure Security Agency (CISA). It has grown from 321 entries in 1999 to more than 300,000.

How an identifier is assigned

A CVE identifier has three parts: the prefix "CVE", the year, and a sequence number. The year reflects when the identifier was reserved or the flaw made public, not when the bug appeared. Until 2014 the sequence was fixed at four digits, which capped each year at 9,999 entries. The CVE Editorial Board voted 15 to 3 in May 2013 for a variable-length format, effective January 1, 2014. That is why 2026 identifiers can run to six digits.

Identifiers are issued by CVE Numbering Authorities (CNAs): organisations authorised to assign them within a defined scope. Most are software vendors numbering flaws in their own products, such as Microsoft, Google or the Linux kernel project. Others are bug bounty platforms, national emergency response teams or open source hosts such as GitHub. More than 530 CNAs were authorised as of August 2026, according to Cybersecurity Dive. CNAs sit beneath "Root" organisations that supervise them, and MITRE acts as the CNA of last resort for flaws no other authority covers. In November 2025 the European Union Agency for Cybersecurity (ENISA) became a Root for European entities.

The process runs in a fixed sequence:

  • Report. A researcher or internal team reports a flaw to the vendor or relevant CNA.
  • Reservation. The CNA reserves an identifier, often weeks before disclosure.
  • Publication. Once a patch or mitigation exists, the CNA publishes a CVE Record with a description, affected products and versions, and references to advisories.
  • Enrichment. Other organisations add data on top: a severity score, a weakness category, product names in machine-readable form, and evidence of exploitation.

Records are rejected when an identifier proves a duplicate or not a vulnerability: 1,787 in 2025, or 3.58%, according to researcher Jerry Gamblin.

Records are published as JSON files in the CVE Record Format. Version 5.0 replaced older formats, whose downloads ended on June 30, 2024; version 5.2.0, which added Package URL (PURL) identifiers for open source packages, went live on October 29, 2025, according to the programme's repository. Beside the CNA's own container, a record can hold containers from "Authorized Data Publishers". Since June 2024 CISA has used one to add scores and exploitation status that CNAs leave out.

The databases around it

CVE names a flaw. Other systems describe it.

The National Vulnerability Database (NVD), run by the National Institute of Standards and Technology (NIST) since 2005, enriches CVE records with a CVSS (Common Vulnerability Scoring System) score on a scale of 0 to 10, a CWE (Common Weakness Enumeration) category, and Common Platform Enumeration (CPE) product names. Scanners need those product names to match an installed version to a flaw. CVSS is maintained by the Forum of Incident Response and Security Teams (FIRST); version 4.0 was published on November 1, 2023.

CISA's Known Exploited Vulnerabilities (KEV) catalogue lists the subset of CVEs with evidence of real-world attacks. The version released today held 1,754 entries, 270 of them added in 2026 and 361 marked as used in ransomware campaigns, according to CISA's data file. Binding Operational Directive (BOD) 26-04, issued on June 10, 2026, makes KEV status one factor in how US federal civilian agencies rank patches, alongside asset exposure, exploit automation and impact. It consolidated two earlier directives, 19-02 and 22-01.

Origins

David Mann and Steven Christey of MITRE proposed a common naming scheme in a paper titled "Towards a Common Enumeration of Vulnerabilities", presented at Purdue University on January 21 and 22, 1999. A working group became the first 19-member CVE Editorial Board, and the list launched publicly in September 1999 with 321 entries. The International Telecommunication Union adopted it as Recommendation X.1520 in 2011.

Volume then rose sharply. CVE records published per year grew from 14,274 in 2020 to 28,312 in 2023, according to Craci, a vulnerability data firm. For 2025, Gamblin counts 48,185 records, up 20.6% on 2024, while Craci counts 47,803, a gap that reflects counting methods. Craci counted 81,927 records published in 2026 by October 20, an average of 281 a day against 131 in 2025.

Why it matters for marketing and publishing

Advertising runs on software someone else wrote. A publisher's site depends on a content management system, a server language, consent tools and dozens of scripts. CVE identifiers are how the owners of that stack learn what to patch.

Today, the PHP project shipped fixes for two flaws rated 9.2 that let attackers run code on servers, CVE-2026-109618 and CVE-2026-109619. Because the bugs sit in the PHP interpreter, a single unauthenticated request can reach them before any WordPress plugin runs, exposing publisher sites, landing pages and checkout forms. That exposure is not hypothetical: research from the hosting company 20i found 88% of WordPress sites running outdated versions in September 2026.

Browser CVEs bear directly on tracking. Mozilla fixed CVE-2026-6770, a Firefox IndexedDB flaw that let sites derive a stable identifier across private windows and Tor Browser resets, in Firefox 150 on April 21, 2026. A bug of that kind is a privacy defect and a potential tracking identifier at once.

Not every concern gets a number. When a researcher showed in April 2026 that Microsoft Edge holds every saved password in cleartext memory at launch, Microsoft called the behaviour "by design", and no CVE was issued. The October 2026 spyware campaign that used ad scripts bought through a demand-side platform to infect targeted devices, documented by Citizen Lab, carried none either. Abuse of a business process, rather than a defect in code, falls outside the system, as does phishing. Botnets, by contrast, are often assembled by exploiting known, numbered flaws in routers and other devices.

Limitations and disputes

Funding. The programme rests on one US government contract. On April 15, 2025, MITRE's Yosry Barsoum warned that the contract, worth $57.8 million, would expire the next day. CISA exercised an 11-month option hours before the lapse, according to The Record. Board members launched the CVE Foundation as a possible independent home. In March 2026 CSO Online reported that the contract had been renegotiated without an expiry date and moved to a protected line in CISA's budget. Terms were not disclosed. Katie Noble, a CVE board member, said at RSAC 2026 that funding still came solely from the US government.

Alternatives. ENISA launched the European Vulnerability Database (EUVD) on May 13, 2025, under the NIS2 Directive. The Computer Incident Response Center Luxembourg (CIRCL) runs GCVE, which lets independent authorities issue identifiers in a GCVE-[authority]-[year]-[number] format and maps existing CVEs to authority 0.

Enrichment. NIST's NVD has carried a backlog since early 2024. On April 15, 2026, NIST said it would enrich only CVEs in the KEV catalogue, software used by federal agencies and "critical software", citing a 263% rise in submissions between 2020 and 2025. Backlogged CVEs published before March 1, 2026, were moved to "Not Scheduled", and NIST stopped adding its own score where a CNA had supplied one.

Inflated and disputed records. In August 2023 curl's lead developer, Daniel Stenberg, objected to CVE-2020-19909, a 2019 bug that the NVD scored 9.8. "NVD really does not try very hard to actually understand or figure out the problem they grade," he wrote, according to The New Stack. The Linux kernel became a CNA on February 13, 2024, and assigns identifiers to almost any bug fix with possible security impact. It issued 5,686 records in 2025, according to Gamblin. Critics see noise; the kernel team argues nearly any bug could be exploitable.

Severity is not risk. A CVSS base score measures potential damage, not likelihood of attack, yet 39.4% of 2025 CVEs were rated high or critical, according to Gamblin.

Not to be confused with

  • CVSS: the 0 to 10 severity score attached to a CVE. A CVE has one identifier but can carry different scores from the CNA, NIST and vendors.
  • CWE: a catalogue of weakness types, such as CWE-79 for cross-site scripting. CWE describes a class of mistake; CVE names one instance in one product.
  • Zero-day: a flaw exploited before the vendor has a fix. Many zero-days receive CVE identifiers later; the term describes timing, not naming.
  • Exploit: code that takes advantage of a flaw. A CVE can exist for years without one.
  • Security advisory: a vendor's or host's notice, such as a GitHub Security Advisory with a GHSA identifier. An advisory usually cites a CVE but is a separate document with its own ID.

Recent developments

Artificial intelligence (AI) is changing the supply of CVEs. GitHub reported a 224% rise in vulnerability reports over 90 days in March 2026 and had published more than 7,000 CVE identifiers by August, according to Cybersecurity Dive. OpenAI and Anthropic were granted temporary CNA status in a pilot to number flaws their models find. At Mozilla, a harness built on Claude Mythos Preview found 271 bugs fixed in Firefox 150. Microsoft's October 13, 2026, Patch Tuesday fixed more than 1,400 CVEs, though trackers disagree on the exact count, with SecurityWeek reporting 1,413 and Brinqa 1,411.

"I don't think it is capable of keeping up at this point," Noble said of the programme in August 2026.

Timeline

  • January 21-22, 1999 - Mann and Christey present "Towards a Common Enumeration of Vulnerabilities" at Purdue University.
  • September 1999 - The CVE List launches with 321 entries.
  • 2005 - NIST launches the National Vulnerability Database.
  • 2011 - The ITU adopts CVE as Recommendation X.1520.
  • May 2013 - The CVE Editorial Board votes 15 to 3 for variable-length identifiers.
  • January 1, 2014 - The new identifier syntax takes effect.
  • November 3, 2021 - CISA launches the KEV catalogue under BOD 22-01.
  • August 2023 - Daniel Stenberg disputes the 9.8 NVD score for CVE-2020-19909.
  • November 1, 2023 - FIRST publishes CVSS 4.0.
  • Early 2024 - An NVD enrichment backlog begins.
  • February 13, 2024 - The Linux kernel becomes a CNA.
  • May 8, 2024 - CVE Record Format 5.1 goes live.
  • June 2024 - CISA's Authorized Data Publisher container starts adding data to records.
  • June 30, 2024 - Legacy CVE download formats end.
  • April 16, 2025 - CISA extends MITRE's contract by 11 months hours before expiry; the CVE Foundation is announced.
  • May 13, 2025 - ENISA launches the European Vulnerability Database.
  • October 29, 2025 - CVE Record Format 5.2.0 adds Package URL support.
  • November 2025 - ENISA becomes a CVE Root for European entities.
  • January 2026 - CIRCL's GCVE draws wider coverage as an alternative allocation system.
  • March 9, 2026 - CSO Online reports the CVE contract renegotiated without an expiry date.
  • April 15, 2026 - NIST limits NVD enrichment to priority CVEs.
  • April 21, 2026 - Firefox 150 fixes CVE-2026-6770 and 271 AI-found bugs.
  • June 10, 2026 - CISA issues BOD 26-04.
  • August 2026 - More than 530 CNAs are authorised; OpenAI and Anthropic join a CNA pilot.
  • October 13, 2026 - Microsoft's Patch Tuesday fixes more than 1,400 CVEs.
  • October 21, 2026 - PHP fixes CVE-2026-109618 and CVE-2026-109619; the KEV catalogue reaches 1,754 entries.

Summary

Who: MITRE runs the CVE Program under contract to CISA, with a board of industry and government members. More than 530 CVE Numbering Authorities, mostly software vendors, assign identifiers. NIST's NVD, CISA, FIRST, ENISA and CIRCL add scores, exploitation data and parallel databases.

What: CVE is a catalogue of unique identifiers for publicly disclosed security vulnerabilities, each with a record describing the affected products, versions and references.

When: Proposed in January 1999 and launched in September 1999, with variable-length identifiers from 2014, a near-lapse of funding in April 2025, NVD cutbacks in April 2026 and record volumes through 2026.

Where: Records are published at cve.org and in the programme's public repository, and consumed by scanners, patch tools, vendor advisories and government directives worldwide, with European counterparts in the EUVD and GCVE.

Why: A shared name is the precondition for coordinated patching. Without it, vendors, defenders and the companies that run publishing and advertising infrastructure could not reliably tell whether they face the same flaw.