CVE number
The ID number that identifies one specific security flaw, like CVE-2026-41709.
CVE stands for Common Vulnerabilities and Exposures. Every publicly known flaw gets a number in the form CVE-YEAR-NUMBER. The year is when the number was assigned, not necessarily when the flaw was found or fixed.
The number is how vendors, security tools, news reports and CISA all refer to the same flaw. A vendor's advisory, a news article and your security scanner may describe it differently, but the CVE number is the same.
Why it matters to you: When an IT provider or a news story mentions a CVE number, you can search it on Patch Sonar to see in plain English who's affected and what to update.
Related terms
- CVSS severity scoreA score from 0 to 10 for how bad a flaw could be if attacked. It measures potential damage, not whether anyone is attacking it.
- CISA's Known Exploited Vulnerabilities catalog (KEV)The U.S. government's official list of software flaws with confirmed real-world attacks, each with a deadline for federal agencies to fix it.
- Exploited vulnerabilityA software flaw that attackers are actually using in real attacks, not just one that could be used in theory.