Common Vulnerabilities and Exposures (CVE) is a publicly available list that assigns a unique identifier to each known security vulnerability so that everyone can refer to the same flaw consistently.
Each entry has an ID in the form CVE-YYYY-NNNN, a short description, and references. The program is run by MITRE with sponsorship from CISA. Importantly, CVE does not rank severity; it only names and describes the flaw. Scoring is handled separately by systems such as CVSS. When a vendor publishes a patch, it usually cites the CVE IDs it fixes, which lets defenders match advisories, scanner output, and patches to the same underlying vulnerability.
A common confusion is treating CVE and CVSS as one thing. CVE is the identifier and CVSS is the score. Vulnerability scanners report CVEs, but a long list means little without prioritizing by severity, exploitability, and business context. Chasing raw CVE counts can hide the two or three flaws that actually put the organization at risk.
How is CVE tested on the CISSP?
CVE fits Domain 6, Security Assessment and Testing, which covers vulnerability scanning, testing, and interpreting results. Expect conceptual questions about what CVE identifies versus how severity is measured. Review it in Domain 6 Security Assessment and Testing.