What Is a CVE?

Last verified on Nov 8, 2026.

A CVE is a unique identifier for one publicly disclosed security vulnerability, such as CVE-2021-44228. The CVE Program's stated mission is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. The identifier is the point: two tools, two advisories, and two people can all say "CVE-2021-44228" and know they mean the same flaw.

CVE Is an Identifier, Not a Database

The CVE Program's own FAQ is direct about this: CVE is not a vulnerability database. It enables the correlation of vulnerability data across tools, databases, and people. Scores, exploit status, and fix advice live elsewhere and attach to the ID. See CVSS for severity, EPSS for exploitation probability, and CISA KEV for confirmed exploitation.

The ID Format

The CVE Record Format schema defines the ID as the string CVE, a year, and a number of 4 to 19 digits. The schema enforces it with a regular expression:

^CVE-[0-9]{4}-[0-9]{4,19}$

The year is not a promise about when the flaw was found. The schema says it should indicate either the year the vulnerability was discovered or the year the ID was published. The number part runs from 4 to 19 digits, so do not assume four. Match IDs with that regular expression, not a fixed width.

Reserved, Published, Rejected

Every record has a state. A new ID starts as reserved: the CVE Program says this means stakeholders are using the ID for early-stage coordination, but the CNA is not ready to disclose the vulnerability publicly. Once the CNA submits the details, including at least one public reference, the record is published. A record can be marked REJECTED if the ID should no longer be used. The record for Log4Shell shows the sequence. It was reserved on 2021-11-26 and published on 2021-12-10, with the Apache CNA (a CVE Numbering Authority) as the assigner. See Log4Shell for the incident itself.

You can read a record yourself. The CVE Services API returns JSON:

curl -s https://cveawg.mitre.org/api/cve/CVE-2021-44228 \
  | jq '{id: .cveMetadata.cveId, state: .cveMetadata.state, published: .cveMetadata.datePublished, assigner: .cveMetadata.assignerShortName}'

{
  "id": "CVE-2021-44228",
  "state": "PUBLISHED",
  "published": "2021-12-10T00:00:00.000Z",
  "assigner": "apache"
}

What Else Uses the ID

Not every vulnerability has a CVE, and a vendor may announce a problem before a record is published. Treat a missing ID as "no identifier yet", not "no problem."

Using CVEs in Practice

A CVE ID is a join key. Put it in tickets, in scanner output, and in your logs when you record a mitigation or an exploit attempt. After a high-profile ID is published, searching request logs for its known payloads is the fastest check of whether you were probed, covered in checking logs for exploit attempts after a CVE. To get alerted when a new advisory touches software you run, see new advisories. For the wider set of security signals in logs, see security issues. More terms are in the glossary.

Looking Up CVEs with cve.now

cve.now, a free feed from Sazabi, keeps one entry per vulnerability. When the same flaw appears under a CVE, GHSA, or OSV id, it merges them, uses the CVE id when one exists, and lists the others as aliases. Try CVE-2021-44228 or browse the known-exploited feed. Sazabi, an AI-native observability and security platform, includes a cve.now connector that is on by default in every project, so its agent can look up a CVE or check a lockfile.