Purpose

CVE Focus
CVE is a dictionary or It assigns unique
Common catalog of publicly identifiers (CVE IDs) to
known information vulnerabilities,
Vulnerabilities security vulnerabilities making it easier to
and Exposures and exposures. share data across
separate vulnerability
databases and
security tools.

CVE
Example Interoperability Hub

A specific instance Managed by CVE's standardized

identifiers facilitate
of a software seamless integration and
vulnerability with It is managed by interoperability among
a unique identifier, the CVE Program, security tools,
streamlining the sharing
e.g., CVE-2023- operated by the and correlation of
12345. MITRE vulnerability information.
Corporation.
 Purpose
CWE Focus
CWE is a community- It provides a
developed list of
Common common software
standardized way to
describe and categorize
Weakness and hardware vulnerabilities,
security weaknesses. weaknesses, and flaws
Enumeration in software
architecture and
development practices.

CWE
Example ·Contextual Insight

Buffer Managed by ·CWE establishes

relationships between
overflows, SQL vulnerabilities,
injection, cross- It is providing a holistic
view of potential
site scripting maintained by interactions within
(XSS), etc. the MITRE intricate software
systems.
Corporation.
 Purpose
NVD Focus
NVD is the U.S.
government It provides information
National repository of on vulnerabilities,
including their
Vulnerability standards-based
vulnerability
descriptions, public
identifiers (CVE IDs), and
Database management data. information about how to
mitigate or remediate the
vulnerabilities.

NVD
Example Severity Metrics

NVD hosts Managed by NVD utilizes metrics

like CVSS scores,
information enabling effective
related to CVEs, It is sponsored by the
vulnerability
National Institute of
including severity Standards and
prioritization and
targeted risk mitigation
scores and impact Technology (NIST) and is
part of the larger NIST strategies.
assessments. Cybersecurity Program.