Security

What are CVE and CVSS?

Also known as: CVE, CVSS, Common Vulnerabilities and Exposures, Common Vulnerability Scoring System

A CVE (Common Vulnerabilities and Exposures) is the public identifier of a known security vulnerability, such as CVE-2021-44228, and CVSS is the 0–10 score that rates its technical severity.

CVE identifiers are assigned by CVE Numbering Authorities and published in the CVE list; the US National Vulnerability Database (NVD) adds CVSS scores and the affected products as CPE names. CVSS measures severity, not likelihood, so it is best combined with exploit data such as EPSS and the CISA KEV catalogue.

How Clateway helps

• Vulnerability management – Scan your systems and technologies for CVEs, prioritise with EPSS and CISA KEV, track SLAs, sync Dependabot alerts and watch SaaS vendor advisories in one place.
• EU Cyber Resilience Act compliance – Prepare for the EU Cyber Resilience Act: product registry, SBOM quality checks, CSAF advisory matching, threat modelling, pen test and conformity evidence.

Related terms

• EPSS (Exploit Prediction Scoring System)
• CISA KEV catalogue
• SBOM (software bill of materials)