Plain-English glossary

The words you'll see in security news and on this site, explained without jargon.

• Zero-dayA security hole that attackers found and used before the software's maker had a fix ready.
• Exploited vulnerabilityA software flaw that attackers are actually using in real attacks, not just one that could be used in theory.
• CISA's Known Exploited Vulnerabilities catalog (KEV)The U.S. government's official list of software flaws with confirmed real-world attacks, each with a deadline for federal agencies to fix it.
• CVE numberThe ID number that identifies one specific security flaw, like CVE-2026-41709.
• CVSS severity scoreA score from 0 to 10 for how bad a flaw could be if attacked. It measures potential damage, not whether anyone is attacking it.
• EPSS (exploit prediction score)A daily estimate, from 0% to 100%, of how likely a flaw is to be exploited in the next 30 days.
• Remote code execution (RCE)A flaw that lets an attacker run their own commands on your computer or server from somewhere else, often over the internet.
• Privilege escalationA flaw that lets someone who already has a little access, like a normal user account, take full control of a system.
• Authentication bypassA flaw that lets an attacker get past a login screen without a valid password.
• Patch TuesdayThe second Tuesday of every month, when Microsoft and several other vendors release their regular security updates.
• RansomwareMalicious software that locks up or steals a business's files and demands payment to get them back.
• Edge deviceEquipment that sits at the boundary between your network and the internet, like a firewall, VPN, router or email gateway.