CVE (Common Vulnerabilities and Exposures)
A public catalog that gives each known security vulnerability one ID, such as CVE-2025-55182, so everyone talks about the same bug.
The program, run by MITRE since 1999, assigns IDs in the form CVE-year-number through CVE Numbering Authorities, including vendors that number bugs in their own products. A CVE entry names the affected product and versions; severity comes separately, usually as a CVSS score. For example, CVE-2025-55182 (“React2Shell”) was a remote code execution flaw in React Server Components disclosed in December 2025.
Related terms
- CVSS (vulnerability severity score): A 0 to 10 score of how severe a vulnerability is, from how it is exploited and what it lets an attacker do.
- Zero-day: A vulnerability attackers know about or exploit before the vendor has a fix, so defenders have had zero days to patch.
- Dependency updates (Dependabot, Renovate): Keeping libraries and frameworks current, usually with bots that open pull requests for new versions.
