A warning from CERT.at, a scan report, and a vendor update often describe the same vulnerability in different words. The CVE identifier, also called CVE number or CVE ID in everyday use, makes it uniquely identifiable. The CVE Program is sponsored by the US cybersecurity agency CISA, and the nonprofit MITRE Corporation runs the secretariat. A CVE entry (CVE Record) describes the vulnerability, names affected products, and refers to vendor advisories. It does not assess the risk and does not contain an update.
How is a CVE number structured?
The identifier follows the pattern CVE-year-number, for example CVE-2024-3094. According to the CVE Program, the year does not indicate when the vulnerability was discovered. The sequence number has at least four digits and no upper limit; six-digit numbers such as CVE-2026-110447 are now commonplace. An entry has one of three states: reserved, published, or rejected, for example when a report turns out to be a duplicate.
Who assigns CVE numbers?
Identifiers are assigned by CVE Numbering Authorities (CNAs). These are authorized organizations with a defined scope, for example software vendors for their own products, security research organizations, and national CERTs. Above them are Roots, which onboard, train, and oversee CNAs. The EU agency ENISA has been a CNA since January 2024 and also a Root since November 2025. If you find a vulnerability yourself, report it to the responsible party as part of a coordinated vulnerability disclosure.
CVE, CVSS, NVD, and EUVD
- CVE names the vulnerability uniquely.
- CVSS describes its technical severity on a scale from 0 to 10.
- The National Vulnerability Database (NVD) of the US institute NIST adds ratings and product lists to entries. Since April 2026, NIST has prioritized enriching exploited vulnerabilities from the KEV catalog and certain software important to US federal agencies; other CVEs are recorded but no longer enriched immediately.
- ENISA's European Vulnerability Database (EUVD) has been in operation since May 2025 and stems from the NIS2 Directive. Among other things, it shows critical, actively exploited, and EU-coordinated vulnerabilities.
In practice for SMEs and municipalities
For smaller organizations, the CVE number is above all a precise search term. If a warning names a CVE, you can quickly determine whether the firewall, the VPN access, or a line-of-business application in the municipal office is affected. This requires an up-to-date inventory of all systems and versions, see IT asset management. For critical advisories, ask your IT service provider specifically about the CVE identifier and the remediation status.
Risks and limitations
- Not every vulnerability has a CVE. Flaws in in-house developments or in pure cloud services often do not appear at all.
- A CVE says nothing about attacks. Whether a vulnerability is being exploited is shown by the KEV catalog and the probability estimate EPSS.
- Volume instead of overview: Without prioritization in vulnerability management, important findings get lost in the flood of new entries.
- Dependence on a single program: In April 2025, the operating contract for CVE was about to expire, and CISA extended it at short notice. With ENISA as a Root and the EUVD, Europe is building its own structures.
How TOMORIS relates
GRID.scout assesses findings with a CVE identifier by reachability, impact, and context, and tracks the measures. GRID.patch supports the planned installation of updates.