# CVE and CVSS

**What do CVE and CVSS mean?**

A CVE number is the unique name of a publicly known weakness. The CVSS value is a figure for its severity on a scale from 0 to 10.

The name makes sure everyone is talking about the same gap. Manufacturers, testing tools and reports use the same number, in a form such as CVE-2024-12345. Without that shared name there would be no way to tell whether two reports mean the same weakness.

The value places the severity. It takes into account, among other things, whether the gap can be exploited remotely, whether an account is needed for it and what damage it does. The scale runs from 0 to 10, commonly split into low (0.1 to 3.9), medium (4.0 to 6.9), high (7.0 to 8.9) and critical (9.0 to 10.0).

The value alone says nothing about your risk. What decides is whether the affected system runs in your business at all, whether it is reachable from the internet and whether the gap is already being exploited. A finding without that placement is a list, not a result.

## Related terms
- [Vulnerability and vulnerability assessment](https://vetosec.at/en/it-security/schwachstelle/)
- [Vulnerability scan](https://vetosec.at/en/it-security/schwachstellenscan/)
- [Patch management and updates](https://vetosec.at/en/it-security/patch-management/)
- [Exploit](https://vetosec.at/en/it-security/exploit/)

## Source
https://vetosec.at/en/it-security/cve-cvss/ (vetosec, pruefung)