CVE vs CVSS vs CWE
A CVE identifier names one specific vulnerability in one product. A CVSS score rates how severe that vulnerability is, from 0 to 10, based on its characteristics. A CWE identifier classifies the type of weakness behind it, such as improper input validation. Your actual risk depends on exposure and exploitation, which none of the three measures.
What each one is for
CVE, Common Vulnerabilities and Exposures. A public identifier for one specific vulnerability in one product, assigned by a CVE Numbering Authority. It answers the question of which flaw everyone is discussing.
CVSS, Common Vulnerability Scoring System. A method maintained by FIRST for scoring severity from 0 to 10, with bands from low to critical. The base score describes intrinsic characteristics: whether the attack is over the network, how complex it is, whether privileges or user interaction are required, and the impact on confidentiality, integrity, and availability. Version 3.1 remains widely used and version 4.0 introduced a revised metric structure.
CWE, Common Weakness Enumeration. A catalogue maintained by MITRE that classifies types of software weakness, such as SQL injection, improper authentication, or use after free. It answers what kind of mistake caused the vulnerability.
A single vulnerability typically has one CVE identifier, one or more CVSS scores from different sources, and one or more CWE classifications.
Where the numbers come from
Vendors and national databases can publish different CVSS scores for the same CVE, because scoring involves judgement about impact and attack requirements. When two sources disagree, read the metric vectors rather than the headline number; the disagreement is usually about one metric such as whether privileges are required.
Reading them together
Base score is not risk. A 9.8 in a component you do not expose is less urgent than a 6.5 on an internet-facing service handling customer data. Base scores deliberately exclude your environment.
Environmental metrics exist for that reason. CVSS includes environmental modifiers that adjust for the importance of the affected asset and compensating controls. Most teams never use them, then complain the score does not reflect their risk.
Threat metrics reflect exploitation. Newer CVSS versions include metrics for exploit maturity, which is closer to what actually drives urgency.
Exploitation data may matter more than the score. Public exploitation reports, proof-of-concept availability, and government catalogues of known exploited vulnerabilities are stronger prioritisation signals than a base score alone. The Exploit Prediction Scoring System, also from FIRST, estimates the probability that a vulnerability will be exploited, which complements severity.
CWE is for patterns, not for prioritising one ticket. If most of your findings map to a handful of weakness classes, that points at training, libraries, or design choices rather than individual patches.
| Dimension | CVE | CVSS | CWE |
|---|---|---|---|
| Answers | Which vulnerability | How severe | What kind of weakness |
| Form | CVE, the year, and a sequence number | A score from 0 to 10 with a metric vector | CWE-79, CWE-89, and similar |
| Maintained by | The CVE programme and its numbering authorities | FIRST | MITRE |
| Scope | One flaw in one product | One flaw's characteristics | A class of software mistake |
| Changes over time | Record updates and version lists | Rescoring and threat metrics | Stable classification |
| Best used for | Tracking and communication | Comparing severity | Finding systemic patterns |
| Does not tell you | Severity or exposure | Your environment or exploitation | Whether you are affected |
Frequently asked questions
- What is the difference between CVE and CVSS?
- A CVE identifier names one specific vulnerability so everyone refers to the same flaw. CVSS is a scoring system that rates how severe a vulnerability is from 0 to 10 based on its characteristics. One identifies, the other measures, and neither describes your exposure.
- What is the difference between CVE and CWE?
- CVE identifies one specific vulnerability in one product, while CWE classifies the underlying type of weakness, such as SQL injection or improper authentication. Many different CVEs can share the same CWE classification, which makes CWE useful for spotting recurring patterns.
- Is a CVSS score the same as risk?
- No. Base scores describe the vulnerability in isolation, excluding your environment. Real risk depends on whether you run the affected versions, how exposed the component is, what data it handles, compensating controls, and whether exploitation is being observed in the wild.
- Should you prioritise vulnerabilities by CVSS score?
- Score alone is a weak prioritiser. Combine it with exposure, asset importance, whether authentication is required, and exploitation signals such as known exploited vulnerability catalogues or exploit prediction scores. A lower-scored flaw under active exploitation usually outranks a higher-scored one that is not.