Get a free 14-day trial of DataBee® Continuous Controls Monitoring (CCM)
Join the Waitlist

Last reviewed and updated | October 20, 2026

CVE

The Common Vulnerabilities and Exposure (CVE) list is a database of all the reported software and hardware vulnerabilities in a given year. They are each provided a CVSS as part of reporting the weakness to the database.

Glossary

Compliance
Control
Continuous controls monitoring (CCM)
Control effectiveness
Control coverage
Control mapping
Control gap
Finding
Traceability
Continuous assurance
Point-in-time audit
Compliance drift
Governance, risk and compliance (GRC)
Compliance
Cybersecurity
Frontier AI
AI-accelerated threat
Exposure management
Continuous threat exposure management (CTEM)
CVSS
Exposure scoring with business context
Asset criticality
Application owner attribution
Remediation validation
Zero-day vulnerability
AI governance
Risk prioritization
Exposure
CVE
Data Management
Entity resolution
Data lineage
Identity and Access
User access review (UAR)
Access certification
Entitlement
Identity governance and administration (IGA)
Disconnected application
Mainframe access review
Reviewer rubber-stamping
Joiner, mover, leaver
Access removal time
Non-human identity
Security Data Fabric
Security data fabric
Open Cybersecurity Schema Framework (OCSF)
Data federation

Why it matters

The CVE list is a central database managed by the MITRE corporation that companies can use to easily understand which software and hardware vulnerabilities have been identified and also which ones have been patched.

How it works

  1. A vulnerability is identified in software or hardware (often by a security researcher).
  2. The vulnerability is reported to the vendor or a relevant numbering authority.
  3. The report is validated and a CVE number is assigned.
  4. The affected vendor produces an update or patch prior to disclosing the CVE.
  5. The numbering authority publishes the official CVE record.