)
)
# CVE, CWE, CVSS, and NVD: A Complete Guide to Vulnerability Acronyms
Vulnerability management relies on four interconnected systems: CVE identifies specific flaws, CWE classifies the underlying weakness types, CVSS scores the severity, and NVD ties it all together in a searchable database. Understanding how these systems connect helps you prioritize patches and communicate risk clearly across your organization.
What is CVE?
CVE stands for Common Vulnerabilities and Exposures. It's a standardized identification system that assigns a unique ID to each publicly disclosed security vulnerability. When you see a reference like CVE-2024-0519, that's a CVE identifier pointing to one specific vulnerability in one specific product.
The CVE program is maintained by the MITRE Corporation under sponsorship from the Cybersecurity and Infrastructure Security Agency (CISA). MITRE coordinates with over 300 CVE Numbering Authorities (CNAs), which are organizations authorized to assign CVE IDs. Major vendors like Microsoft, Google, Apple, and Red Hat serve as CNAs for their own products.
A CVE entry contains a brief description of the vulnerability, the affected software, and references to vendor advisories and patches. It does not include a severity score or detailed technical analysis. Those come from CVSS and NVD.
As of early 2025, the CVE database contains over 240,000 entries, with more than 28,000 new CVEs published in 2024 alone (CVE.org, 2025). That volume is why automated patch management is essential. No IT team can manually triage tens of thousands of new vulnerabilities per year.
What is CWE?
CWE stands for Common Weakness Enumeration. While CVE catalogs specific vulnerability instances, CWE catalogs the types of software weaknesses that cause those vulnerabilities. Think of CVE as a police report for a specific break-in and CWE as the building code violation that made the break-in possible.
MITRE also maintains CWE. The database organizes software weaknesses into a hierarchical structure, from broad categories down to specific technical flaws. For example:
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer (broad category)
CWE-122: Heap-based Buffer Overflow (specific weakness under CWE-119)
This hierarchy lets security teams analyze vulnerabilities at different levels of detail. A CISO might care that your applications have "memory safety issues" (high level). A developer needs to know that function X has a "heap-based buffer overflow in the parsing routine" (specific).
MITRE publishes an annual CWE Top 25 Most Dangerous Software Weaknesses list based on the frequency and severity of real-world vulnerabilities. The 2024 list includes weaknesses like use-after-free (CWE-416), race conditions (CWE-362), and authentication bypass (CWE-287).
What is CVSS?
CVSS stands for Common Vulnerability Scoring System. It provides a standardized method for rating the severity of vulnerabilities on a scale from 0.0 to 10.0. The score translates into qualitative ratings that help IT teams prioritize their patching queues.
| CVSS score range | Severity rating | Patching priority |
|---|---|---|
| 0.0 | None | Monitor only |
| 0.1 - 3.9 | Low | Schedule for next maintenance window |
| 4.0 - 6.9 | Medium | Patch within 30 days |
| 7.0 - 8.9 | High | Patch within 14 days |
| 9.0 - 10.0 | Critical | Patch immediately |
The Forum of Incident Response and Security Teams (FIRST) maintains CVSS. The current version is CVSS v4.0, released in November 2023, which introduced more granular scoring metrics than its predecessor.
CVSS v4.0 evaluates vulnerabilities across four metric groups:
Base metrics. The intrinsic characteristics of the vulnerability: attack vector (network, adjacent, local, physical), attack complexity, privileges required, user interaction, and impact on confidentiality, integrity, and availability.
Threat metrics. Whether exploit code exists and is being used in the wild.
Environmental metrics. How your specific infrastructure modifies the base score. A vulnerability that's critical for internet-facing servers might be low risk for air-gapped systems.
Supplemental metrics. Additional context like automatable exploitation, recovery capability, and value density.
A critical distinction: CVSS scores the technical severity of a vulnerability, not the business risk to your specific organization. A CVSS 9.8 vulnerability in software you don't run is irrelevant. A CVSS 5.5 vulnerability in your most critical application might be an emergency. Use CVSS as a starting point for prioritization, not the final word.
What is NVD?
NVD stands for National Vulnerability Database. Maintained by the National Institute of Standards and Technology (NIST), NVD is the U.S. government's central repository of vulnerability information. It takes CVE entries and enriches them with CVSS scores, CWE classifications, affected product information, and references to patches and advisories.
When a new CVE is published, NVD analysts review it and add:
A CVSS base score (using CVSS v3.1 and, increasingly, v4.0)
One or more CWE classifications identifying the underlying weakness type
Common Platform Enumeration (CPE) data specifying exactly which product versions are affected
Links to vendor patches and security advisories
NVD is the primary data source for most vulnerability scanning tools, patch management platforms, and risk assessment frameworks. When your vulnerability scanner reports that an endpoint has a critical vulnerability, it's typically pulling that information from NVD.
In 2024, NVD experienced significant processing delays due to resource constraints, creating a backlog of unanalyzed CVEs. NIST addressed this by onboarding additional CVE Numbering Authorities to help with analysis and by awarding CISA a contract to improve processing throughput (NIST, 2024). This backlog underscored why organizations should not rely solely on NVD. Supplementing with vendor advisories and CISA's KEV catalog provides more timely threat intelligence.
How do CVE, CWE, CVSS, and NVD work together?
These four systems form a pipeline from vulnerability discovery to prioritized remediation. Here's how they connect using a real example.
Step 1: Discovery and CVE assignment. A security researcher discovers a heap buffer overflow in a widely used application. The vendor, acting as a CNA, assigns it CVE-2024-XXXXX.
Step 2: CWE classification. NVD analysts classify the vulnerability as CWE-122 (Heap-based Buffer Overflow), placing it within the broader CWE-119 memory corruption category.
Step 3: CVSS scoring. NVD analysts calculate the CVSS base score. If the vulnerability is remotely exploitable without authentication and leads to full system compromise, the score might land at 9.8 (Critical).
Step 4: NVD publication. The enriched entry, now containing the CVE ID, CWE classification, CVSS score, affected products (CPE), and patch references, is published on NVD.
Step 5: Your vulnerability scanner picks it up. Your scanning tools query NVD, match the affected product versions against your software inventory, and flag the vulnerability for remediation.
Step 6: You patch. Based on the CVSS score and whether the CVE appears on CISA's Known Exploited Vulnerabilities catalog, you prioritize and deploy the patch. Automox provides the ability to automate this step across your entire endpoint fleet.
| System | Full name | Maintained by | What it does | Example |
|---|---|---|---|---|
| CVE | Common Vulnerabilities and Exposures | MITRE (sponsored by CISA) | Assigns unique IDs to specific vulnerabilities | CVE-2024-0519 |
| CWE | Common Weakness Enumeration | MITRE | Categorizes the types of software weaknesses | CWE-416 (Use-After-Free) |
| CVSS | Common Vulnerability Scoring System | FIRST | Scores vulnerability severity from 0.0 to 10.0 | 9.8 (Critical) |
| NVD | National Vulnerability Database | NIST | Enriches CVEs with scores, classifications, and references | Links CVE + CWE + CVSS + CPE |
Why does this matter for IT operations?
Understanding these systems directly improves your vulnerability management workflow.
Faster triage. When a new CVE is announced, you can immediately check its CVSS score and CWE type to estimate impact. A CWE-416 (use-after-free) or CWE-362 (race condition) vulnerability with a CVSS score above 9.0 warrants immediate attention.
Better communication. Using standardized identifiers like CVE IDs and CVSS scores lets you communicate risk to leadership without lengthy technical explanations. "We have three Critical CVEs with CVSS 9.0 or higher that require emergency patching" is a sentence any executive can understand.
Audit readiness. Regulatory frameworks like PCI DSS, HIPAA, and FedRAMP reference CVE and CVSS directly. Documenting that you remediated CVE-XXXX-XXXXX within the required timeframe is straightforward when your tools track by CVE ID.
Informed prioritization. Not every vulnerability needs a same-day patch. CVSS scores, combined with your knowledge of which endpoints are exposed and which software is installed, let you allocate patching resources where they reduce the most risk. Building a consistent patching practice around these scores keeps your environment consistently hardened.
How can you stay current with new vulnerability disclosures?
Keeping up with the volume of new CVEs requires a combination of automation and curated sources.
NVD feeds. Subscribe to NVD's data feeds for automated ingestion into your vulnerability management tools.
CISA KEV catalog. Monitor the Known Exploited Vulnerabilities catalog for CVEs confirmed to be exploited in the wild. These are your highest priority.
Vendor advisories. Subscribe to security bulletins from Microsoft, Apple, Google, and other vendors whose software runs on your endpoints.
CWE Top 25. Review the annual list to understand which weakness types are producing the most real-world vulnerabilities. This informs your development team's secure coding priorities.
For deeper dives into specific vulnerability types referenced throughout this guide, explore the full series:
Sources
MITRE Corporation. "About CVE." https://www.cve.org/About/Overview
MITRE Corporation. "CWE - Common Weakness Enumeration." https://cwe.mitre.org/
FIRST. "Common Vulnerability Scoring System v4.0." https://www.first.org/cvss/v4-0/
NIST. "National Vulnerability Database." https://nvd.nist.gov/
CISA. "Known Exploited Vulnerabilities Catalog." https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Frequently asked questions
CVE identifies a specific vulnerability in a specific product, like a police report for one incident. CWE identifies the type of software weakness that caused the vulnerability, like the building code violation that made the incident possible. One CWE type can be responsible for hundreds of CVE entries.
CVE numbers are assigned by CVE Numbering Authorities (CNAs), which are organizations authorized by MITRE to assign CVE IDs. Major software vendors like Microsoft, Google, and Apple are CNAs for their own products. Security researchers can also request CVE IDs through MITRE directly or through a CNA in their industry.
From a security perspective, a lower CVSS score is better because it indicates lower severity. Vulnerabilities scored 0.1-3.9 are Low severity, 4.0-6.9 are Medium, 7.0-8.9 are High, and 9.0-10.0 are Critical. Most patching policies prioritize Critical and High vulnerabilities for immediate or near-immediate remediation.
NIST faced resource constraints that caused a significant backlog in analyzing and enriching new CVE entries. The agency addressed this by expanding the number of organizations contributing analysis and by partnering with CISA to improve throughput. The delays highlighted the importance of supplementing NVD data with vendor advisories and CISA's KEV catalog.
CVSS scores the severity of a specific vulnerability instance (a CVE). CWSS (Common Weakness Scoring System) scores the severity of a weakness type (a CWE). CVSS tells you how bad a specific bug is. CWSS tells you how dangerous a category of bugs tends to be. Most IT operations teams work primarily with CVSS because they patch specific vulnerabilities, not abstract weakness types.
Yes. You can search NVD directly at nvd.nist.gov, browse CWE entries at cwe.mitre.org, and look up CVE IDs at cve.org. For ongoing vulnerability management across an endpoint fleet, automated tools that ingest NVD data and match it against your software inventory save significant time and reduce the risk of missing critical patches.
Automox provides automated patch management that helps you remediate CVEs across Windows, macOS, and Linux endpoints. When vendors release patches addressing specific CVE IDs, Automox lets you deploy those updates across your fleet from a single console, prioritized by severity and organizational policy.
)
)
)
)