CVE

Informational

Common Vulnerabilities and Exposures

Definition

CVE (Common Vulnerabilities and Exposures) is a unique, standardized identification system for publicly known security vulnerabilities. Each vulnerability receives a CVE-YEAR-NUMBER identifier (for example, CVE-2021-44228 for Log4Shell). It is maintained by MITRE Corporation and is the global standard for referencing vulnerabilities.

Impact

Unambiguous identification of vulnerabilities globallyCoordination between security teams and vendorsBasis for patches and security updatesRemediation prioritization with the associated CVSSReference in bug bounty reports and audits

Examples

Famous CVEs in security history

Some historic CVEs: CVE-2021-44228 (Log4Shell) enabled RCE on millions of Java servers. CVE-2017-5638 (Apache Struts) caused the Equifax breach. CVE-2014-0160 (Heartbleed) exposed the memory of OpenSSL servers. Each one changed the security industry.

External references

MITRE CVE database NVD - National Vulnerability Database

Related terms

CWE

Common Weakness Enumeration

CVSS

Common Vulnerability Scoring System

OWASP Top 10

Zero-Day

Responsible Disclosure

Practice CVE with real labs

Apply what you've learned in safe environments based on real bug bounty reports.

See practice labs

hunters training: 712
labs from real reports: 55
completions: 1,206
in bounties practiced: $213,970

46 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy

BBLabs · bug bounty training

Stop reading about bugs and start hunting them

Create your free account and practice on labs based on real reports that paid out thousands of euros. The Academy is free forever.

Create free account See the labs

No card · free Academy · cancel anytime