Which statement correctly describes the purpose of a CVE?

Which statement correctly describes the purpose of a CVE?

• A. It provides vendor advisories for products
• B. It scores vulnerabilities on risk
• C. It provides standardized identifiers for publicly known vulnerabilities and exposures
• D. It lists only exploited vulnerabilities

Answer: (C)

CVE provides standardized identifiers for publicly known vulnerabilities and exposures. Each vulnerability receives a unique CVE ID, which lets different tools, databases, and security teams talk about the same issue unambiguously, enabling reliable cross-referencing and coordination across advisories, patches, and research. This isn’t about vendor advisories themselves—those are communications from vendors describing fixes, while CVEs are the identifiers that those advisories often cite. It also isn’t about how severe a vulnerability is—that role belongs to CVSS, which scores risk rather than naming the issue. And CVEs cover publicly known vulnerabilities, not only those that have been exploited.

CVE provides standardized identifiers for publicly known vulnerabilities and exposures. Each vulnerability receives a unique CVE ID, which lets different tools, databases, and security teams talk about the same issue unambiguously, enabling reliable cross-referencing and coordination across advisories, patches, and research.

This isn’t about vendor advisories themselves—those are communications from vendors describing fixes, while CVEs are the identifiers that those advisories often cite. It also isn’t about how severe a vulnerability is—that role belongs to CVSS, which scores risk rather than naming the issue. And CVEs cover publicly known vulnerabilities, not only those that have been exploited.