TechKnowSurge
CompTIA Security+ 2.3 CompTIA CySA+ 2.5 NIST 800-53 SI-5 ISC2 CISSP 7.8 CompTIA Security+ 4.3 CompTIA CySA+ 2.2 NIST 800-53 RA-5 CompTIA CySA+ 2.3
TechKnowSurge Catalog Videos Common Vulnerabilities and Exposures (CVE)
VideoSecurityFree

Common Vulnerabilities and Exposures (CVE)

The Common Vulnerabilities and Exposures (CVE) list is a publicly searchable database of over 240,000 known security vulnerabilities, giving security professionals and attackers alike visibility into existing weaknesses across software and systems.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

The Common Vulnerabilities and Exposures (CVE) list is a publicly maintained database that tracks known security flaws across software, firmware, and web-based platforms. Hosted at cve.org, the database currently holds over 240,000 records, with new entries added daily as vulnerabilities are discovered and formally categorized. Each CVE entry includes a standardized identifier, a discovery or categorization date, severity scoring, and technical details about the nature of the flaw — providing a consistent reference point for security teams across industries. Vulnerabilities follow a defined lifecycle. A flaw may exist from the moment a feature ships, often referred to as a zero-day because developers have no lead time to respond before it can potentially be exploited. Once discovered and reported, the vulnerability is assigned a CVE record, making it part of the shared knowledge base that security professionals use to prioritize patching efforts on their networks and systems. The CVE list presents a clear tradeoff. For defenders, it is an invaluable tool — searchable by keyword, vulnerability type, or CVE ID — that enables proactive identification and remediation of known weaknesses. A search for SQL injection, for example, returns pages of categorized entries spanning multiple years, each linking to detailed records that can help administrators assess whether their systems are affected. The disadvantage is that the same information is equally accessible to malicious actors, who can use it to target unpatched systems. Staying current with CVE disclosures and deploying patches promptly are fundamental responsibilities for anyone managing network or system security.

What you'll learn

What's covered

CVE (Common Vulnerabilities & Exposures)

Aligned to

CompTIA Security+
2.3 Explain various types of vulnerabilities.
4.3 Explain various activities associated with vulnerability management.
CompTIA CySA+
2.5 Explain concepts related to vulnerability response, handling, and management.
2.2 Given a scenario, analyze output from vulnerability assessment tools.
2.3 Given a scenario, analyze data to prioritize vulnerabilities.
NIST 800-53
SI-5 Security Alerts, Advisories, and Directives
RA-5 Vulnerability Monitoring and Scanning
ISC2 CISSP
7.8 Implement and support patch and vulnerability management

Key terms

Vulnerability
A weakness in a system, application, or process that can be exploited by a threat actor.
Common Vulnerabilities and Exposures
CVE
Common Vulnerabilities and Exposures is a publicly maintained dictionary that assigns unique identifiers to known software and hardware vulnerabilities, providing a common reference point for vulnerability tracking, disclosure, and remediation.
Zero-Day
A vulnerability that is unknown to the vendor and has no available patch at the time of exploitation.
Patch Management
The process of acquiring, testing, and installing software updates to fix vulnerabilities and improve functionality.
Exploit
A piece of software or technique that takes advantage of a vulnerability to gain unauthorized access or cause harm.
SQL Injection
SQLi
An attack that inserts malicious SQL code into a query to manipulate a database.

Topics

Cve Vulnerability Management Threat Intelligence Cybersecurity Security Databases Network Remediation

Transcript

There's a list of known vulnerabilities that are already out there. We call it the CVE, or the Common Vulnerabilities and Exposures.

The life cycle of a vulnerability

Vulnerabilities have a life cycle. A vulnerability gets released — something, maybe a feature, gets released and it has a vulnerability in it. This is zero day, because the developers have zero days to respond to it. At some point in time it gets discovered by the company or by others, and then it gets, at some point in time, put on the Common Vulnerabilities and Exposures.

Now, there's a pro and a con to having this list right here. The pro is that as security people we can then identify what the vulnerabilities are and then go and try to fix those on our network. The disadvantage, though, is now any hacker can also see those vulnerabilities and try to use it, to be able to leverage it to be able to have access to our network, or be able to have access to our equipment. And so there's both a pro and a con to having this list. It becomes really important to be able to identify when we have vulnerabilities on our network and then deploy patches so that way we fix the vulnerability.

Searching the CVE list

So this is cve.org, the Common Vulnerabilities and Exposures list. This is where it resides, the database of it. It says currently there are 240,000 CVE records, and there's more being discovered every day. We could actually download this list, or we could search the list. In fact, there's this search box right up here and it says enter keyword. It could be the CVE ID, which we don't know any at this point, so let's skip that. But it also says what it is that you can search for, so this says SQL injection. So let's do that — let's look for SQL injection and hit enter.

And these are a list of all of the SQL injections. You can see it's stated by the year and then has this little code here, so 23931, 23913. So these are all of the ones just with the SQL injection, all the different SQL injection attacks that are known. And there's pages and pages of this, so there's a lot. Even just this first page is all 2025.

Looking at a single record

So let's click on one of these and see a little more information about it. We have now the ID that we talked about — that's one thing that we could type in that search, is this ID here. And then we've got information about this. So it's discovered on, or at least categorized on, January 9th of 2025, and then we see details about it, like a scoring here, the severity, we've got the version of it. So we've got information in regards to this vulnerability that we have here.

And this particular one has to do with, it looks like, something on WordPress — we see WordPress right here. So if we have a WordPress site that's up and running, we might want to go and check it to see if it's got this vulnerability and if we need to patch it.

So once again, this is a huge benefit to us, because we can now fix any issues, any vulnerabilities we have on our network. But it also is a little bit of a disadvantage, because now the hackers out there know this as well, so we better keep up on this.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →