Skip to main content
Precursor Security
Glossary

CVE Database

A CVE database is a structured, searchable catalogue of publicly disclosed software vulnerabilities, each identified by a unique CVE ID and recorded with a description, the affected products, references and a severity score. The canonical public source is the US National Vulnerability Database (NVD), which enriches the CVE List maintained by MITRE.

Reviewed by the Precursor Security teamSecurity glossary

A CVE database catalogues known software vulnerabilities under one identifier, so everyone refers to the same flaw in the same way. Each entry carries a CVE ID in the form CVE-YYYY-NNNNN, a short description, the affected products and versions, and links to advisories and patches.

The CVE List is maintained by MITRE, which assigns the identifiers. The US National Vulnerability Database (NVD) then enriches each record with a CVSS severity score, a CWE weakness type and structured product data (CPE). Most security tools draw on both: MITRE for the identifier, NVD for the analysis.

A CVE record tells you what a flaw is and how severe it could be, but not whether it is being exploited. With roughly 40,000 new CVEs disclosed each year, a raw catalogue quickly becomes unmanageable, and severity alone does not tell a team what to fix first.

A CVE database is not a vulnerability scanner. A scanner detects which CVEs are present on your estate; the database is the reference catalogue those findings map back to.

Turning a catalogue into a decision takes exploitation signal. EPSS exploitation probability, CISA KEV confirmed-exploitation status and live honeypot telemetry separate the handful of CVEs that matter now from the tens of thousands that do not.

Precursor Intelligence unifies the CVE database with EPSS, CISA KEV, CWE impact weighting, threat-actor attribution and Shadowserver honeypot data behind one exploitation risk score. It is queryable through a REST API, a dashboard and a read-only MCP server, so an engineer or an AI agent can look up a CVE, its exploitation likelihood and its real-world status in a single call.

Query the CVE database from your agent
Related terms
EPSS (Exploit Prediction Scoring System)
EPSS (Exploit Prediction Scoring System) is a FIRST.org model that outputs, for each CVE, the probability it will be exploited in the wild within the next 30 days: a 0 to 1 score updated daily. It predicts likelihood of exploitation, where CVSS measures technical severity.
CISA KEV (Known Exploited Vulnerabilities)
The CISA Known Exploited Vulnerabilities (KEV) catalogue is a curated list of CVEs that CISA has confirmed are being actively exploited in the wild. It is a high-signal patch-first list, but it is not exhaustive. Many mass-exploited CVEs are never added.
Security Vulnerability
A security vulnerability is a weakness in a system, application or process that an attacker can exploit to compromise confidentiality, integrity or availability. Vulnerabilities arise from software flaws, misconfigurations, weak credentials or design errors, and are catalogued publicly as CVEs with severity scored by CVSS.