Robots Atlas>ROBOTS ATLAS
Safety

CVE

1999ActivePublished: 2 September 2026Updated: 2 September 2026Published
Key innovation
Introduced a single public, standardized identifier (CVE ID) for each known vulnerability, letting different tools and databases reference the same flaw unambiguously.
Category
Safety
Abstraction level
System
Operation level
DeploymentSystem
Use cases
Standardized referencing of vulnerabilities across security toolsVulnerability management and patch prioritizationVulnerability scanners and SIEM systemsSoftware supply-chain security analysisFeeding threat-intelligence tools and AI cybersecurity systems

How it works

When a vulnerability is discovered and reported, an authorized CNA (CVE Numbering Authority) reserves and assigns a CVE ID. A CVE Record contains the identifier, a short description of the flaw, and at least one public reference. The record is published in the CVE catalog (cve.org). Downstream systems such as NVD then enrich the record with additional metadata and a CVSS score. The identifier format is CVE-YYYY-NNNN; since 13 January 2015 the sequential digit count is variable to accommodate more than 9,999 entries per year.

Problem solved

Before CVE, each tool vendor and vulnerability database used its own naming for the same flaw, making it impossible to correlate data across systems. CVE solves this by giving each vulnerability one shared identifier.

Evolution

1999
CVE launched by MITRE
Inflection point

MITRE publicly launches the CVE List in September 1999 as a common dictionary of known vulnerabilities.

2015
Variable-length CVE ID format
Inflection point

From 13 January 2015, IDs use a variable number of sequential digits, removing the limit of 9,999 entries per year.

2025
Funding uncertainty and contract extension

MITRE's contract to run the CVE Program nearly expired; an 11-month extension was granted and funding was stabilized into 2026.