What does CVE stand for?
CVE stands for Common Vulnerabilities and Exposures. A public catalogue that gives each known vulnerability a unique identifier, such as CVE-2021-44228, so everyone refers to the same flaw.
A CVE is an identifier for one publicly known vulnerability, in the form CVE, the year, and a number, for example CVE-2021-44228. The CVE Program assigns the identifiers through organizations called CVE Numbering Authorities. The point is a common name: scanners, vendor advisories and patch notes can all refer to the same flaw without ambiguity. A CVE says a flaw exists, not how serious it is.
CVE in practice: an example
A scanner reports CVE-2021-44228 on an application server. The analyst looks the identifier up, finds that it is the Log4j remote code execution flaw, reads the vendor advisory that names the fixed version and checks the CVSS score to set the priority.
What CVE is confused with
CVE vs CVSS: what is the difference?
CVE is the name of a vulnerability. CVSS is the score that rates its severity. What CVSS stands for
CVE vs CWE: what is the difference?
A CWE is a type of weakness, such as SQL injection. A CVE is one specific instance of a weakness in a specific product. What CWE stands for
Which exams cover CVE?
CVE is on the official CompTIA acronym list for one of the four exams covered here.
- Security+ SY0-801: 2.1 (Threats, Vulnerabilities, and Attacks).
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. A vendor bulletin, a scanner report and a news article all need to refer to the same flaw without confusion. What do they use?
- A CVSS score
- A CVE identifier
- A MAC address
- A serial number
Show the answer
B. A CVE identifier. The CVE identifier is the shared name. A score can be the same for thousands of different flaws.
2. Which statement about a CVE entry is correct?
- It always includes a working exploit
- It identifies a specific publicly disclosed vulnerability
- It is a category of coding mistakes
- It measures how likely exploitation is
Show the answer
B. It identifies a specific publicly disclosed vulnerability. A CVE names one disclosed vulnerability. Categories are CWE; likelihood of exploitation is what EPSS estimates.
Sources: CVE Program: overview; NIST glossary: Common Vulnerabilities and Exposures. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.