* [Topics](/en/topics "Topics") * What is a CVE? What is a CVE? ============== Published September 4, 2024•*4*-minute read Copy URL Jump to section --------------- OverviewHow does it work?What qualifies as a CVE?What is the CVSS?What is the Security Data API? Overview -------- CVE, short for Common Vulnerabilities and Exposures, is a list of publicly disclosed computer security flaws. When someone refers to a CVE, they mean a security flaw that's been assigned a CVE ID number. Security advisories issued by vendors and researchers almost always mention at least 1 CVE ID. CVEs help IT professionals coordinate their efforts to prioritize and address these vulnerabilities to make computer systems as secure as possible. This video can't play due to privacy settings To change your settings, select the "Cookie Preferences" link in the footer and opt in to "Advertising Cookies or try disabling adblockers." How does the CVE system work? ----------------------------- In 1999, MITRE Corporation, a U.S. Government-funded research and development company, developed [the CVE system](https://www.cve.org), a uniform standard for reporting and tracking software security bugs. CVE entries are brief. They don’t include technical data or information about risks, impacts, and fixes. Those details appear in other databases, including the [U.S. National Vulnerability Database (NVD)](https://nvd.nist.gov/), the [CERT/CC Vulnerability Notes Database](https://www.kb.cert.org/vuls/), and various lists maintained by vendors and other organizations. Across these different systems, CVE IDs give users a reliable way to recognize unique vulnerabilities and coordinate the development of security tools and solutions. The MITRE Corporation maintains the CVE list, but a security flaw that becomes a CVE entry is often submitted by organizations and members of the open source community. ### About CVE identifiers CVE identifiers (or CVE IDs) are assigned by a [CVE Numbering Authority (CNA)](https://www.cve.org/ProgramOrganization/CNAs). [Approximately 100 CNAs](https://cve.mitre.org/cve/request_id.html) exist, including security companies, research organizations, and major IT vendors such as Red Hat, IBM, Cisco, [Oracle](https://partner-finder.oracle.com/catalog/Partner/SC2PP-REDHAT#profile-solutions), and [Microsoft](/en/partners/microsoft). MITRE can also issue CVEs directly. CNAs are issued blocks of CVE IDs, which the CNAs hold in reserve to attach to new issues as they're discovered. Thousands of [CVE IDs](https://www.cvedetails.com/browse-by-date.php) are issued every year. A single complex product, like an operating system (OS), can accumulate hundreds of CVEs. This means it's particularly vulnerable once it enters its end-of-maintenance phase (when bug fixes and security patches stop being issued) and end-of-life phase (when all first-party support ends). For example, when CentOS Linux 7 entered its end-of-life period on July 1, 2024, a new CVE was announced within a day. This underscores the importance of migrating to a stable OS that receives regular security patches and updates. [Migrate from CentOS Linux to Red Hat Enterprise Linux](/en/technologies/linux-platforms/enterprise-linux/centos-migration) Anyone—a vendor, a researcher, or just an astute user—can discover a security flaw and bring it to someone's attention. Many vendors offer [bug bounties](https://en.wikipedia.org/wiki/Bug_bounty_program) to encourage responsible disclosure of security issues. If you find a vulnerability in [open source software](/en/topics/open-source/what-is-open-source-software) you should [submit it to the relevant community](https://opensource.com/article/19/3/bug-reporting). One way or another, information about the flaw makes its way to a CNA. The CNA then assigns the information a CVE ID. Finally, the new CVE is posted on the [CVE website](https://www.cve.org/). A CNA often assigns a CVE ID before making the security advisory public. Vendors commonly keep security flaws secret until they've developed and tested fixes to help prevent attackers from exploiting unpatched flaws. Once made public, a CVE entry includes the CVE ID (in the format "CVE-2019-1234567"), a brief description of the security vulnerability or exposure, and references, which can include links to vulnerability reports and advisories. Optimize Linux security with Red Hat ------------------------------------ [Get the resource](/en/resources/optimize-linux-security-overview "Get the resource") What qualifies as a CVE? ------------------------ According to the [CVE Numbering Authority operational rules](https://www.cve.org/ResourcesSupport/AllResources/CNARules), CVE IDs are assigned to flaws that meet specific criteria. Flaws must: * **Be independently fixable.** The flaw can be fixed independently of any other bugs. * **Be acknowledged by the affected vendor or documented.** The software or hardware vendor acknowledges the bug's existence and confirms that it negatively impacts security. Alternatively, the reporter must have shared a vulnerability report that demonstrates both the negative impact of the bug *and* that it violates the security policy of the affected system. * **Affect only 1 codebase.** If a flaw impacts more than 1 product, it gets a separate CVE for each product. In cases of shared libraries, protocols or standards, the flaw gets a single CVE only if there’s no way to use the shared code without being vulnerable. Otherwise each affected codebase or product gets a unique CVE. [6 strategies to strengthen your IT foundation](/en/resources/6-strategies-to-strengthen-it-foundations-checklist) What is the Common Vulnerability Scoring System? ------------------------------------------------ There are multiple ways to evaluate the severity of a vulnerability. One is the [Common Vulnerability Scoring System (CVSS)](https://www.first.org/cvss/), a set of open standards for assigning a number to a vulnerability to assess its severity. The NVD, CERT, and others use CVSS scores to assess the impact of vulnerabilities. Scores range from 0.0 to 10.0, with higher numbers representing a higher degree of severity. Many security vendors have created their own scoring systems as well. ### 3 key takeaways **Know your deployments.** Just because a CVE exists doesn’t mean the risk applies to your specific environment and deployment. Be sure to read each CVE to validate that it's relevant (wholly or partially) to your environment's operating system, application, modules, and configurations. **Practice vulnerability management.** [Vulnerability management](/en/topics/security/what-is-vulnerability-management) is a repeatable process to identify, classify, prioritize, remediate, and mitigate vulnerabilities. This means understanding how a risk would apply to your organization so you can properly prioritize any outstanding vulnerabilities that need to be addressed. **Be ready to communicate.** CVEs will impact your organization’s systems because of both the vulnerabilities themselves and any potential downtime required to address them. Communicate and coordinate with your internal customers, and share the vulnerabilities with any central risk-management function in your organization. ### How Red Hat works with CVEs As a major contributor to [open source](/en/topics/open-source/what-is-open-source) software, Red Hat is continuously engaged in the security community. Red Hat is a CNA and uses CVE IDs to track security vulnerabilities. Red Hat Product Security maintains an open and frequently updated database of security updates, which you can view by CVE number. Red Hat also continues to address CVEs rated Critical or Important for products in end of maintenance (EOM), like Red Hat Enterprise Linux 7, through our [Extended Lifecycle Support](/en/blog/not-ready-upgrade-rhel-7-4-years-extended-life-cycle-support-now-available) (ELS) program. [Explore the Red Hat CVE database](https://access.redhat.com/security/security-updates/#/cve) What is the Red Hat Security Data API? -------------------------------------- Red Hat Product Security provides access to raw security data on the [Red Hat Customer Portal](https://www.redhat.com/security/data/metrics/) and in a machine-consumable format with the Security Data API (application programming interface). In addition to the security reports and metrics Red Hat produces, customers can use this raw data to produce their own metrics for their unique situations. The data provided by the Security Data API includes OVAL (Open Vulnerability and Assessment Language) definitions, Common Vulnerability Reporting Framework (CVRF) documents, and CVE data. Data is available in XML or JSON format. This video can't play due to privacy settings To change your settings, select the "Cookie Preferences" link in the footer and opt in to "Advertising Cookies or try disabling adblockers." [Access Red Hat Security Data API documentation](https://docs.redhat.com/en/documentation/red_hat_security_data_api/1.0/html/red_hat_security_data_api/index) The official Red Hat blog ------------------------- Get the latest information about our ecosystem of customers, partners, and communities. [Keep reading](/en/blog "The official Red Hat blog") All Red Hat product trials -------------------------- Our no-cost product trials help you gain hands-on experience, prepare for a certification, or assess if a product is right for your organization. [Keep reading](/en/products/trials "All Red Hat product trials") Keep reading ------------ ### What is security automation? Security automation uses technology to perform tasks with reduced human assistance to integrate security processes, applications, and infrastructure. [Read the article](/en/topics/automation/what-is-security-automation "article | what is security automation") ### What is SOAR? SOAR refers to 3 key software capabilities that security teams use: case and workflow management, task automation, and a centralized means of accessing, querying, and sharing threat intelligence. [Read the article](/en/topics/security/what-is-soar "article | what is soar") ### What's an insider threat? An insider threat is leaked or misused data that—whether released accidentally or purposefully—could be used in malicious ways or viewed by individuals who shouldn’t have legitimate access. [Read the article](/en/topics/security/what-are-insider-threats "article | What's an insider threat") Security resources ------------------ ### Related content * Blog post [Reducing CVE fatigue with Red Hat Hardened Images and Anchore](/en/blog/reducing-cve-fatigue-red-hat-hardened-images-and-anchore) * Blog post [The path to zero trust: Bridging the gap between AI development and OpSec](/en/blog/golden-path-zero-trust-bridging-gap-between-ai-development-and-opsec) * Blog post [CVE-2026-31431: How Red Hat Advanced Cluster Security and Red Hat Advanced Cluster Management can help](/en/blog/cve-2026-31431-how-red-hat-advanced-cluster-security-and-red-hat-advanced-cluster-management-can-help) * Blog post [Accelerate innovation and govern integrity with Red Hat Satellite 6.19](/en/blog/accelerate-innovation-and-govern-integrity-red-hat-satellite-619) ### Related articles * [What is microsegmentation?](/en/topics/virtualization/microsegmentation) * [What is AI security?](/en/topics/ai/what-is-ai-security) * [What is patch management?](/en/topics/management/what-patch-management-and-automation) * [What is security automation?](/en/topics/automation/what-is-security-automation) * [What is SOAR?](/en/topics/security/what-is-soar) * [What's an insider threat?](/en/topics/security/what-are-insider-threats) * [What is post-quantum cryptography?](/en/topics/security/post-quantum-cryptography) * [What is software supply chain security?](/en/topics/security/what-is-software-supply-chain-security) * [What is lightweight directory access protocol (LDAP) authentication?](/en/topics/security/what-is-ldap-authentication) * [What is secrets management?](/en/topics/devops/what-is-secrets-management) * [What is confidential computing?](/en/topics/security/what-is-confidential-computing) * [What are SPIFFE and SPIRE?](/en/topics/security/spiffe-and-spire) * [Red Hat Enterprise Linux security](/en/technologies/linux-platforms/enterprise-linux/security) * [What is zero trust?](/en/topics/security/what-is-zero-trust) * [Functional safety and continuous certification on Linux](/en/topics/open-source/functional-safety-and-continuous-certification-on-linux) * [What is access control?](/en/topics/security/what-is-access-control) * [What is role-based access control (RBAC)?](/en/topics/security/what-is-role-based-access-control) * [What is kubernetes security?](/en/topics/containers/kubernetes-security) * [Shift left vs. shift right](/en/topics/devops/shift-left-vs-shift-right) * [Red Hat Lightspeed data and application security](/en/topics/management/data-application-security) * [What is CI/CD security?](/en/topics/security/what-is-cicd-security) * [What is an intrusion detection and prevention system (IDPS)?](/en/topics/security/what-is-an-IDPS) * [What is security information and event management (SIEM)?](/en/topics/security/what-is-SIEM) * [The increasing importance of cybersecurity in banking](/en/topics/financial-services/increasing-importance-cybersecurity-banking) * [Gain security with Red Hat Ansible Automation Platform](/en/technologies/management/ansible/gain-security-with-red-hat-ansible-automation-platform) * [What is edge security?](/en/topics/security/what-is-edge-security) * [What is the importance of operational resilience?](/en/topics/financial-services/what-is-operational-resilience) * [What is vulnerability management?](/en/topics/security/what-is-vulnerability-management) * [What is backup and recovery?](/en/topics/security/backup-and-recovery) * [What is container security?](/en/topics/security/container-security) * [What is DevSecOps?](/en/topics/devops/what-is-devsecops) * [What is compliance management?](/en/topics/management/what-is-compliance-management) * [Why choose Red Hat for DevSecOps](/en/topics/devops/why-choose-red-hat-for-devsecops) * [What is cloud governance?](/en/topics/automation/what-is-cloud-governance) * [Security in the software development lifecycle](/en/topics/security/software-development-lifecycle-security) * [Kubernetes security best practices](/en/topics/containers/kubernetes-security-best-practices) * [Security for IoT devices](/en/topics/security/security-for-iot-devices) * [What is identity and access management (IAM)?](/en/topics/security/what-identity-and-access-management-iam) * [Advantages of Kubernetes-native security](/en/topics/containers/advantages-of-kubernetes-native-security) * [Container and Kubernetes compliance considerations](/en/topics/containers/compliance) * [Intro to Kubernetes security](/en/topics/containers/intro-kubernetes-security) * [What is risk management?](/en/topics/management/what-is-risk-management) * [What is SELinux?](/en/topics/linux/what-is-selinux) * [Hybrid cloud security](/en/topics/security/what-is-hybrid-cloud-security) * [What is financial services security (and compliance)?](/en/topics/security/security-and-compliance-financial-services) * [What is API security?](/en/topics/security/api-security) * [What is malware?](/en/topics/security/what-is-malware) * [What is cloud security](/en/topics/security/cloud-security) [More about this topic](/en/topics/security "More about this topic")