CVE stands for Common Vulnerabilities and Exposures.
The CVE system was launched in 1999 to provide a standardized, publicly recognized way to identify and track cybersecurity vulnerabilities and exposures.
The CVE database is managed by the National Cybersecurity FFRDC (a Federally Funded Research and Development Center), operated by MITRE Corporation and funded by the U.S. Department of Homeland Security.
Each CVE is assigned a unique identifier (for example, CVE-2023-12345), making it easier for security teams, vendors, and tools to reference and discuss the same vulnerability consistently.
What is CVSS?
The Common Vulnerability Scoring System (CVSS) is used to measure the severity of a CVE.
CVSS scores range from 0 to 10:
9.0–10.0 – Critical
7.0–8.9 – High
4.0–6.9 – Medium
0.1–3.9 – Low
The higher the score, the more severe the potential impact of the vulnerability.
What is an Attack Vector (AV)?
Attack Vector (AV) describes how close an attacker needs to be to exploit a vulnerability.
This metric reflects the context in which exploitation is possible:
Vulnerabilities that can be exploited remotely over the internet receive a higher score
Vulnerabilities that require local or physical access receive a lower score
The logic is simple: the easier it is to exploit a vulnerability remotely, the greater the number of potential attackers, and the higher the overall risk.
Attack Vector is one of the key components that influences the CVSS base score.
How does Panorays prioritize CVEs?
Panorays automatically sorts and prioritizes CVEs to help you focus on what matters most:
KEV status
CVEs that appear in CISA’s Known Exploited Vulnerabilities (KEV) catalog are prioritized first.
CVSS score
Remaining CVEs are sorted by severity, from highest to lowest CVSS score
This ensures that actively exploited vulnerabilities and high-impact risks are surfaced first, enabling faster and more effective remediation.