External terms
Common Vulnerabilities and Exposures — the canonical identifier for a
publicly known vulnerability, for example CVE-2026-12345. One CVE, one
specific defect.
Common Vulnerability Scoring System — a 0.0 to 10.0 severity score computed from exploitability and impact characteristics. Higher is more severe. Note that CVSS measures theoretical severity; it does not say whether anyone is actually exploiting the flaw.
Exploit Prediction Scoring System — a probability (0–100%) that a vulnerability will be exploited in the wild in the near future. EPSS answers “how likely is this to be attacked?”; CVSS answers “how bad if attacked?”
The CISA Known Exploited Vulnerabilities catalog — vulnerabilities with confirmed active exploitation. Presence in KEV is the strongest practical signal to prioritize a fix.
Other terms you will see
Section titled “Other terms you will see”- CNA — CVE Numbering Authority; an organization authorized to assign CVEs.
- NVD — the U.S. National Vulnerability Database, the public CVE corpus.
- ATT&CK — MITRE’s knowledge base of adversary tactics and techniques.
- YARA — a tool and rule format for identifying malware by content patterns; a YARA rule is not a network rule.