CVEs, or Common Vulnerabilities and Exposures, are standardized public identifiers assigned to specific cybersecurity vulnerabilities. A CVE identifier lets security teams, software vendors, and researchers refer to the same flaw consistently across advisories, vulnerability databases, and patch records. The identifier itself does not explain how severe a flaw is or whether it has been exploited; those details come from accompanying information.
In practice, defenders use CVEs to identify affected products and versions, prioritize updates, and check whether systems remain exposed. For example, a Node.js security advisory may identify a Brotli decoder flaw by its CVE, helping operators match the issue to their installed runtime and locate the relevant fix. Asset inventories and vulnerability scanners can also use CVE identifiers to flag vulnerable software. A CVE is a tracking label, not a patch or a guarantee of risk: teams should review the affected versions, severity, exposure, and available remediation.