CVE

A CVE (Common Vulnerabilities and Exposures) is a public record of a known security defect, and a shared language for discussing defects. A record can include a description, severity score, and links to fixes.

Counting CVEs tells you little. A rising count can mean a worsening product or a maturing discovery program. A low count can mean a safe product or a manufacturer that isn't looking.

The CWE field names the defect class. A class that keeps recurring after a manufacturer says it was fixed is the number worth tracking (see UV-01).

Discussion prompts

• How quickly can your team determine whether a new CVE affects your product or development environment?
• What recurring CVE classes appear in your product's history?
• How does your quality program use CVEs to track progress?