CVE (Common Vulnerabilities and Exposures)

A Common Vulnerability and Exposure (CVE) is a standardized identifier for a publicly disclosed software vulnerability, maintained by MITRE and widely used across the security industry. Each CVE entry includes a description, severity score, and affected software versions, enabling organizations to identify and prioritize remediation. Black Kite maintains a CVE database and maps CVEs to specific vendors' digital footprints to identify which organizations are running vulnerable software versions and how exploitable those instances are.

How Does a Vulnerability Become a CVE?

More than 48,000 CVEs were published in 2025, up about 18% from roughly 41,000 the year before, according to Black Kite's 2026 Supply Chain Vulnerability Report. Only around 800 of them were ever confirmed exploited in the wild. That gap between a rising count and a small confirmed-exploited subset is the whole problem with treating a CVE list as a to-do list. Most of the volume isn't the danger, and finding the fraction that is takes more than a spreadsheet of identifiers, which is why Black Kite maintains a public CVE database with exploitation context, and maps vulnerabilities to vendor digital footprints inside the platform.

A researcher, vendor, or security team reports a flaw to a CVE Numbering Authority, which assigns an ID and a brief description before the record goes public. The CVE Program has run this way since 1999, when MITRE introduced a shared naming system because every vendor and tool described the same flaw differently.

A CVE identifier follows a fixed pattern, such as CVE-2025-32711, tying the flaw to the year its ID was assigned. Once assigned, the ID feeds into the National Vulnerability Database and every scanner, advisory, and vulnerability feed downstream of it. Where the flaw actually sits in your own vendor ecosystem is a separate question the CVE record doesn't answer.

How Is a CVE Different From a CVSS Score or a KEV Entry?

A CVE names the flaw. A CVSS score rates how severe it could be. A KEV listing confirms someone is exploiting it right now, and only the last one confirms active exploitation. Each one attaches to the record at a different point and answers a different question:

CVE: the identifier. It names the flaw so every team is talking about the same thing.
CVSS: the severity score. It attaches after the fact and rates how bad the flaw could theoretically be.
KEV: the exploitation signal. It confirms someone is actively using the flaw right now.

A single CVE can sit at a Critical CVSS score for months without ever appearing in KEV, and a lower-scored CVE can land in KEV the week attackers start using it against real targets. Treating a CVE ID as the whole story skips the two layers that actually determine urgency.

Why Doesn't Counting CVEs Tell You Your Real Risk?

Because most published CVEs never touch your vendor ecosystem at all, and the ones that do rarely matter equally. Black Kite Research Group™ manually analyzed 1,240 high-priority CVEs in 2025, a 59% jump from 780 the year before, and 84% of them carried a High or Critical rating.

The volume breaks down further once you look past the headline count:

Only 329 of those CVEs cleared the bar for OSINT discoverability, the point where an outside attacker could find the flaw without any inside access.
Two CVEs alone, CVE-2025-26465 and CVE-2025-32728, each matched more than 100,000 companies in Black Kite's dataset.
Roughly 82% of all company-to-CVE matches fell outside the 20 most prevalent flaws, spread across niche vendors, industrial control systems, and mid-market software publishers.

Watching only the famous vendors and the highest CVSS scores misses most of where a vendor ecosystem is actually exposed.

How Does Black Kite Prioritize CVEs for Vendor Risk?

Black Kite runs a four-stage filter that narrows the full CVE feed down to what a vendor risk team should act on today:

OSINT discoverability: whether an outside attacker could find the flaw at all.
Exploitability: using EPSS probability scores confirmed against the KEV catalog.
Vendor mapping: matching the CVE to vendors whose externally visible assets appear to run the affected software.
Overlap: flagging where all three stages converge as the zone that needs outreach now.

In 2025, that process produced 158 FocusTags®, covering more than 329 related CVEs and split by confidence level so a risk team knows how certain the match is before reaching out to a vendor. Each tag can be shared with affected vendors through The Bridge™, turning 'are you affected by this CVE' into a specific, evidence-backed question a vendor's security team can act on.

Mature programs built this way close the loop far faster than a generic questionnaire ever could. Black Kite's 2026 Supply Chain Vulnerability Report notes that mass questionnaires yield response rates around 30%, while evidence-based outreach targets rates above 70%.

A vulnerability assessment built only around raw CVE volume would flag thousands of items a week, most of them noise. This approach, covered across Black Kite's TPRM and TPCRM glossary, is built to flag the handful that need a call today, and to give the vendor's team the specific evidence to act on it.