DevSecOps in Practice

Common Vulnerabilities and Exposures (CVEs)

Ever heard of a "CVE"? Think of it like a unique ID tag for software and hardware security problems. It's how we keep track of those pesky flaws that could let bad actors sneak into our systems. Imagine you find a loose brick in a wall. You'd want to tell everyone about it, right? That's what a CVE does for digital security. It's a way to standardize and share information about vulnerabilities, so everyone can get them fixed.

CVEs are managed by MITRE Corporation, and are publicly available in the National Vulnerability Database (NVD), where details like severity, impact, and mitigation steps are documented.

Each CVE looks something like this: CVE-2024-3651. Let's break it down:

• CVE: This just means "Common Vulnerabilities and Exposures."
• 2024: The year the vulnerability was discovered and assigned an ID.