A CVE is a public ID for one specific security flaw in software. It looks like CVE-2026-12345. An approved group called a CVE numbering authority hands it out. Think of it like a claim ticket at a repair shop. Whoever you talk to, the number points to the same problem, so nobody mixes it up with another one.
Because the name is shared, software vendors, vulnerability databases and security notices can all refer to the same flaw without confusion. You will often see related terms nearby, such as CVSS and NVD.
Why it matters
When you hear about a security problem in an AI tool your organization uses, the CVE is the quickest way to check whether it applies to you. Write it down and ask your vendor: “Are we affected by this CVE, and is it fixed in the version we use?” Most of our advisories match one CVE record. Some come from a GitHub security advisory that has no CVE ID. So if a problem has no CVE, that does not mean it is minor or can be ignored.
Published Updated