CVE & CVSS Basics — A Practical Guide

CVE stands for Common Vulnerabilities and Exposures. It's a public catalogue, maintained by MITRE and cross-published by the NVD (NIST), that gives each discovered software flaw a globally unique identifier — e.g. CVE-2024-12345.

Anyone — a researcher, a vendor, or a national CERT — can request a CVE ID for a vulnerability they discover. Once assigned, that ID becomes the shared reference every tool, advisory and patch-note uses to describe the same issue.

1. Discovery. A researcher, vendor, or automated scanner finds a flaw and reports it, usually under coordinated disclosure.
2. Reservation. A CVE Numbering Authority (CNA) reserves an ID before public details exist.
3. Publication. Once the vendor ships a fix or an embargo expires, the CVE record is published with the affected products, description, and references.
4. Analysis. NVD adds a CVSS score, CPE product mapping and CWE weakness category — usually within days, but sometimes weeks.
5. Enrichment. Feeds like CISA KEV mark actively exploited CVEs; EPSS estimates the probability of exploitation in the next 30 days.
6. Remediation. Security teams triage, patch or mitigate, and track SLA against severity.

CVSS (Common Vulnerability Scoring System) rates each CVE on a 0–10 scale. The current standard is CVSS v3.1 (v4.0 is being adopted). A score is derived from a vector like CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Severity buckets:

• Critical — 9.0 to 10.0
• High — 7.0 to 8.9
• Medium — 4.0 to 6.9
• Low — 0.1 to 3.9
• None — 0.0

The vector encodes attack vector (Network, Adjacent, Local, Physical), attack complexity, required privileges, user interaction, scope, and CIA impact (Confidentiality, Integrity, Availability).

CVSS measures theoretical severity — how bad the flaw could be if exploited. It doesn't tell you whether attackers are actually using it, whether the affected product is in your environment, or whether the exposed asset is business-critical.

Modern triage combines CVSS with:

• EPSS — probability of exploitation in the wild over the next 30 days.
• CISA KEV — known-exploited vulnerabilities the US government has observed in real attacks.
• Asset context — is the affected product on a crown-jewel host or an isolated dev machine?
• Exposure — is the vulnerable service reachable from the internet or only internally?

CWE (Common Weakness Enumeration) groups CVEs by the type of bug that caused them — CWE-79 Cross-site scripting, CWE-89 SQL injection, CWE-787 Out-of-bounds write, and so on.

CWEs turn a flood of individual CVEs into engineering themes: instead of chasing 40 XSS bugs one at a time, teams invest in output-encoding standards or a stricter template engine and retire the whole category.

A pragmatic weekly loop for a security team:

1. Pull new CVEs affecting inventoried vendors and products.
2. Filter by KEV first, then EPSS > 10%, then Critical/High CVSS.
3. Route each item to an owner queue with an SLA proportional to exposure.
4. Patch, mitigate, or accept — always record the decision.
5. Review CWE trends monthly to fix categories of bugs, not just instances.

That's exactly what the VulnMonitor dashboards are built to automate — from the Priority Action Matrix down to the Weakness Lineage view. Not sure how CVEs and CWEs differ? Read CWE vs CVE explained.