When a vulnerability is discovered and reported, an authorized CNA (CVE Numbering Authority) reserves and assigns a CVE ID. A CVE Record contains the identifier, a short description of the flaw, and at least one public reference. The record is published in the CVE catalog (cve.org). Downstream systems such as NVD then enrich the record with additional metadata and a CVSS score. The identifier format is CVE-YYYY-NNNN; since 13 January 2015 the sequential digit count is variable to accommodate more than 9,999 entries per year.
Before CVE, each tool vendor and vulnerability database used its own naming for the same flaw, making it impossible to correlate data across systems. CVE solves this by giving each vulnerability one shared identifier.
MITRE publicly launches the CVE List in September 1999 as a common dictionary of known vulnerabilities.
From 13 January 2015, IDs use a variable number of sequential digits, removing the limit of 9,999 entries per year.
MITRE's contract to run the CVE Program nearly expired; an 11-month extension was granted and funding was stabilized into 2026.
