Vulnerability and CVE

A vulnerability is a mistake in software or its configuration that someone can exploit to do what they should not: read other people's data, take over a server, crash a service. It is usually an ordinary bug with bad consequences, like a login check that can be skipped or a form that runs whatever text you type into it. Every large program has some; the question is who finds them first.

When one is found in software many people use, it gets a CVE id (Common Vulnerabilities and Exposures), like CVE-2021-44228, the famous Log4Shell. The id is a shared name, so a vendor, a security team and a news article can be sure they are talking about the same flaw. Each CVE usually comes with a CVSS score from 0 to 10 that estimates how severe it is: how easy it is to exploit, whether it needs a password, and how much damage it allows.

The fix is a security patch, and the dangerous window is the time between the flaw becoming public and the patch being installed, because attackers read the same announcements and scan the internet for systems that did not update. Worse is a zero-day: a flaw attackers already exploit before the vendor knows about it, so there are zero days to prepare. That is why 'install updates' is still the most useful security advice there is.