CVE, CWE, and CVSS Scoring
Understand vulnerability identifiers, weakness classifications, and severity scoring with real examples.
CVE, CWE, and CVSS Scoring is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What is a CVE?
CVE (Common Vulnerabilities and Exposures) is a standardized identifier for publicly known vulnerabilities. Each CVE has a unique ID (e.g., CVE-2021-44228), a description, and references to patches and advisories.
CVE ID Structure
CVE IDs follow the format CVE-YEAR-NUMBER. The number portion has no leading zeros and can be 4+ digits. MITRE assigns CVE IDs; the NVD enriches them with severity scores.
# Famous examples:
CVE-2021-44228 # Log4Shell (Log4j)
CVE-2017-0144 # EternalBlue (MS17-010)
CVE-2014-0160 # Heartbleed (OpenSSL)
CVE-2021-34527 # PrintNightmareWhat is a CWE?
CWE (Common Weakness Enumeration) classifies the root cause weakness type, not the specific instance. CVEs map to CWEs — understanding the weakness type helps write secure code to prevent entire classes of vulnerabilities.
# Common CWEs:
CWE-89: SQL Injection
CWE-79: Cross-Site Scripting
CWE-78: OS Command Injection
CWE-22: Path Traversal
CWE-502: Deserialization of Untrusted DataCVSS Overview
CVSS (Common Vulnerability Scoring System) provides a numerical score (0.0–10.0) reflecting severity. CVSS v3.1 is the current standard, with a Base Score, Temporal Score, and Environmental Score.
# CVSS Score Ranges:
# 0.0 = None
# 0.1-3.9 = Low
# 4.0-6.9 = Medium
# 7.0-8.9 = High
# 9.0-10.0 = CriticalCVSS Base Metrics: Exploitability
Exploitability metrics measure how easily a vulnerability can be attacked: Attack Vector (network/adjacent/local/physical), Attack Complexity, Privileges Required, and User Interaction.
# Log4Shell CVSS v3.1 Base Score: 10.0
# AV:N = Network (exploitable remotely)
# AC:L = Low complexity
# PR:N = No privileges required
# UI:N = No user interactionCVSS Base Metrics: Impact
Impact metrics measure the consequence of a successful exploit: Confidentiality Impact, Integrity Impact, and Availability Impact — each scored None/Low/High.
Reading CVSS Vector Strings
The full CVSS vector encodes all metrics in a compact string. Tools like the NVD CVSS calculator let you decode and adjust scores for your environment.
# Log4Shell vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
# Decode at:
# https://nvd.nist.gov/vuln-metrics/cvss/v3-calculatorSearching NVD and CVE Databases
The National Vulnerability Database (nvd.nist.gov) is the authoritative source. Search by CVE ID, vendor, product, or CWE. Exploit databases (exploit-db.com) link CVEs to working exploits.
# CLI tools:
# searchsploit searches ExploitDB locally
searchsploit log4j
searchsploit --cve 2021-44228
# Query NVD API
curl "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2021-44228"EPSS: Exploit Prediction Scoring
EPSS (Exploit Prediction Scoring System) predicts the probability that a CVE will be exploited in the wild within 30 days. High CVSS + high EPSS = patch immediately.
Prioritizing CVEs in Practice
Not all critical CVEs are equally dangerous to your environment. Prioritize by: Is the vulnerable software running? Is the attack vector relevant? Is there a public exploit? What is the business impact?
CVE Lifecycle
Researchers discover bugs, report them (often privately), vendors release patches, CVEs are published. The window between patch release and exploitation (patch gap) is often days — patch management speed matters.
Quick Check
What CVSS score range is considered Critical?
Summary: CVE, CWE, CVSS
CVEs identify specific vulnerabilities; CWEs classify their root-cause weakness type; CVSS scores their severity. Together they form the language of vulnerability management. Focus on CVEs with high CVSS scores, high EPSS probability, and confirmed presence in your environment.
Frequently asked questions
Is the “CVE, CWE, and CVSS Scoring” lesson free?
Yes — the full text of “CVE, CWE, and CVSS Scoring” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “CVE, CWE, and CVSS Scoring”?
Understand vulnerability identifiers, weakness classifications, and severity scoring with real examples. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “CVE, CWE, and CVSS Scoring” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.