Glossary
Vulnerability and patching terms, defined
13 terms are defined here, each on its own sourced page. The newest are Exploit, Common Platform Enumeration (CPE) and Common Vulnerabilities and Exposures (CVE), the latest published November 2, 2026.
One page per term: the definition first, then what a patch desk does with it and where it shows up on this site. Each entry is sourced to the organization that owns the term and carries a last-reviewed date. Every term here is also gathered, with the site’s guides and trackers, on the patch and vulnerability management hub.
Updated
C
- Common Platform Enumeration (CPE)CPE is NIST's structured naming scheme for software, systems and packages. How a CPE 2.3 name reads, how NVD uses CPE to match CVEs, and why inventories need it.Also: CPE, CPE name, CPE 2.3, CPE Dictionary
- Common Vulnerabilities and Exposures (CVE)CVE gives each publicly disclosed vulnerability one ID and record. How IDs are assigned, how CVE differs from NVD, CVSS and KEV, and how a patch desk uses it.Also: CVE, CVE ID, CVE Record
- Common Vulnerability Scoring System (CVSS)CVSS rates a vulnerability's technical severity from 0 to 10. What version 4.0 changed in November 2023, why it is not a risk score, and how patch teams use it.Also: CVSS, CVSS v4.0, CVSS score
- Common Weakness Enumeration (CWE)CWE is the community list of software and hardware weakness types behind CVEs. How it differs from CVE, the 2025 Top 25, and what a patch desk does with CWE IDs.Also: CWE, CWE ID, CWE Top 25
E
- ExploitAn exploit takes advantage of a flaw. NIST's own definition, FIRST.org's exploit code maturity levels, and where CISA's KEV catalog draws the line at exploited.Also: exploit code, security exploit, exploit kit
- Exploit lagExploit lag is Daily CISO's count of days between a CVE's NVD publication and CISA's KEV listing. How it is calculated, how to read it, and what it does not show.Also: exploit lag, KEV lag, disclosure-to-KEV lag
- Exploit Prediction Scoring System (EPSS)EPSS estimates the probability that a CVE will be exploited in the next 30 days. How FIRST publishes it, how to read score and percentile, and how it differs from CVSS.Also: EPSS, EPSS score, EPSS percentile
K
N
P
S
V
Z
Longer explainers live in the guides.