SECAI Core · phase 14 of 15 · noun
Common Vulnerabilities and Exposures
A scheme for identifying vulnerabilities developed by MITRE and adopted by NIST.
The Explain card
- Plain English
- CVE is a naming scheme developed by MITRE and adopted by NIST that gives each publicly known vulnerability a unique identifier, so everyone is talking about the same flaw.
- Example
- A security researcher finds that a popular machine learning library executes arbitrary code when loading a crafted model file. The flaw receives a CVE identifier, and scanners, advisories and patch notes all reference it.
- Why it matters
- AI systems run on ordinary software with ordinary bugs. CVE identifiers let defenders track which flaws affect their AI stack and confirm they have been patched.
- Hook
- A passport number for every bug.
Word knowledge
How the word is built, where it came from, and what it sits beside in memory.
In a sentence
The scanner matches an installed Log4j version to Common Vulnerabilities and Exposures entry CVE-2021-44228 before the administrator applies the patch.
Why these words
- Common Latin communis, shared, through Anglo-French and Middle English marks the title as shared across organizations and security tools
- Vulnerabilities Latin vulnus, wound, through Late Latin vulnerabilis provides the first plural noun and the letter V in CVE
- and Old English and coordinates the two plural nouns while remaining lowercase
- Exposures English expose plus -ure, with expose ultimately from Latin exponere, to set forth provides the second plural noun and the letter E in CVE
Where it came from
- Origin
- a MITRE coinage assembled from existing English security terms
- Entered the language
- 1999
- What changed
- The early wording Common Enumeration of Vulnerabilities became Common Vulnerabilities and Exposures, and the initial letters formed the fixed abbreviation CVE.
How it is spelled
- Pattern
- vulnerability changes final y to ie before plural s in vulnerabilities
- Pattern
- exposure keeps its final e when plural s is added
- Pattern
- the principal words are capitalized, while the conjunction and remains lowercase
Spelled like
- capabilities
- liabilities
- closures
- measures
Broken into chunks
-
com-mon
- commonly
- commonality
-
vul-ner-a-bil-i-ties
- vulnerable
- invulnerability
-
and
- or
- but
-
ex-po-sures
- expose
- exposure
What it sits beside
Same subject
- CVE identifier
- Common Vulnerability Scoring System
- National Vulnerability Database
- Common Weakness Enumeration
Same shape
- Common Weakness Enumeration
- Common Platform Enumeration
- Common Attack Pattern Enumeration and Classification
cybersecurity names beginning with Common
- Common Vulnerabilities and Exposures
- Common Weakness Enumeration
- Common Platform Enumeration
Where it sits in the deck
Phase 14: Incident Response, Evaluation, and Knowledge Bases
When detection fires, teams need structured response plans, scoring frameworks, and curated knowledge bases to triage, measure, and learn from AI security events.
