Skip to content

Security Concepts & Data Sources

Plain-language answers to common security questions visitors ask. These are industry-standard concepts, independent of any one product.

What is a CVE?

A CVE (Common Vulnerabilities and Exposures) is a public identifier for a specific, publicly known security vulnerability — for example CVE-2024-12345. The CVE system is run by MITRE and sponsored by the U.S. CISA (Cybersecurity and Infrastructure Security Agency). Each CVE gives the whole industry one common name for the same flaw.

Where does CVE and vulnerability data come from?

The recognized industry sources are:

  • MITRE CVE List — assigns the CVE identifiers themselves.
  • NVD (National Vulnerability Database) — run by the U.S. NIST; enriches each CVE with severity scoring, affected-product details, and references. NVD is the most widely used reference database.
  • Vendor advisories — the affected software vendors' own security bulletins.

Security tools (EDR, vulnerability scanners, cloud security platforms) pull from these sources and report the CVEs they find on your assets.

What is CVSS?

CVSS (Common Vulnerability Scoring System), maintained by FIRST.org, scores a vulnerability's technical severity from 0.0 to 10.0 (Low, Medium, High, Critical). It answers "how bad is this flaw in principle?"

What is EPSS?

EPSS (Exploit Prediction Scoring System), also from FIRST.org, estimates the probability that a vulnerability will be exploited in the near term. It complements CVSS: severity versus likelihood.

What is the CISA KEV catalog?

The CISA Known Exploited Vulnerabilities (KEV) catalog lists vulnerabilities that are actively being exploited in the real world. A CVE appearing in KEV is a strong signal to prioritize it, because attackers are using it now.

How does XPosture use these?

XPosture reads the vulnerabilities and CVEs that your connected tools report on your assets, and uses standard signals like known-exploitation status to help prioritize what matters — see What data we access. For how a specific finding or CVE appears in your environment, the team can walk you through it on your own data.