CVE — Common Vulnerabilities and Exposures
A CVE (Common Vulnerabilities and Exposures) is a unique identifier assigned to a publicly known security vulnerability. When a security researcher discovers a vulnerability in a piece of software, they can request a CVE ID from MITRE. The ID (like CVE-2021-44228 for Log4Shell) becomes the universal reference for that vulnerability across all security tools, databases, and documentation.
What a CVE ID tells you
A CVE ID has a simple structure: CVE-[year]-[number]. The year is when the CVE was assigned (not necessarily when the vulnerability was discovered or fixed). The number is a sequential ID within that year.
CVE-2021-44228 is Log4Shell — discovered and assigned a CVE in December 2021. CVE-2022-22965 is Spring4Shell — 2022. The year in the ID is a rough indicator of when the vulnerability became publicly known.
CVE vs NVD vs OSV — what's the difference
These are related but separate things that confuse a lot of people:
- CVE — just the ID number. Assigned by MITRE. No scoring, no detail beyond a brief description.
- NVD (National Vulnerability Database) — the US government database that enriches CVEs with CVSS scores, affected versions, and references. Often lags behind CVE assignment by days to weeks.
- OSV (Open Source Vulnerabilities) — Google's database focused on open source packages. Much faster than NVD, maps vulnerabilities directly to package versions. What PackageFix uses.
- GHSA (GitHub Security Advisory) — GitHub's advisory database, often the first place a CVE gets detailed package-version information.
Why some vulnerabilities don't have CVE IDs
Getting a CVE assigned takes time — sometimes weeks or months after a fix is released. Aikido's research found that 67% of open source vulnerability patches were released without ever receiving a CVE. This is a real blind spot: npm audit only checks CVE databases, so it misses the majority of patched vulnerabilities that were never formally disclosed.
Check your dependencies for CVEs, CISA KEV entries, and supply chain risks.
Open PackageFix →Free · No signup · No CLI · Runs in your browser