Lesson 1.6: CVE, CVSS, CWE and the KEV catalog
Every week brings hundreds of new vulnerabilities. Defenders sort them with shared vocabulary: a CVE ID names each one, CVSS scores how severe it could be, CWE says what kind of mistake caused it, and CISA's Known Exploited Vulnerabilities (KEV) catalog says which ones attackers are actually using. Other sources add context, such as EPSS (the probability of exploitation) and vendor and national CERT advisories. In the lab you read five well-known CVEs in the NVD's own JSON format, compare their scores and vectors, see their weakness types, and check which are confirmed as exploited.
16 min
You will learn to
- Explain CVE, CVSS, CWE, KEV and EPSS
- Read NVD JSON with jq
- Interpret a CVSS vector
- Use the KEV catalog
- Tell severity from evidence of exploitation
Key terms
- CVE
- Common Vulnerabilities and Exposures: a unique ID for a publicly known vulnerability.
- CVSS
- Common Vulnerability Scoring System: a 0–10 severity score from a vector of properties.
- CWE
- Common Weakness Enumeration: the type of mistake behind a vulnerability.
- KEV
- CISA's catalog of vulnerabilities with evidence of active exploitation.
- EPSS
- Exploit Prediction Scoring System (FIRST): the estimated probability a CVE is exploited in the next 30 days.
← Issuing a certificate from an internal CA · All lessons · What is cybersecurity? Confidentiality, integrity, availability →