Glossary

Vulnerability and patching terms, defined

One page per term: the definition first, then what a patch desk does with it and where it shows up on this site. Each entry is sourced to the organization that owns the term and carries a last-reviewed date.

12 terms

C

Common Platform Enumeration (CPE)CPE is NIST's structured naming scheme for software, systems and packages. How a CPE 2.3 name reads, how NVD uses CPE to match CVEs, and why inventories need it.Also: CPE, CPE name, CPE 2.3, CPE Dictionary
Common Vulnerabilities and Exposures (CVE)CVE gives each publicly disclosed vulnerability one ID and record. How IDs are assigned, how CVE differs from NVD, CVSS and KEV, and how a patch desk uses it.Also: CVE, CVE ID, CVE Record
Common Vulnerability Scoring System (CVSS)CVSS rates a vulnerability's technical severity from 0 to 10. What version 4.0 changed in November 2023, why it is not a risk score, and how patch teams use it.Also: CVSS, CVSS v4.0, CVSS score
Common Weakness Enumeration (CWE)CWE is the community list of software and hardware weakness types behind CVEs. How it differs from CVE, the 2025 Top 25, and what a patch desk does with CWE IDs.Also: CWE, CWE ID, CWE Top 25

E

K

Known Exploited Vulnerabilities (KEV) catalogCISA's KEV catalog lists CVEs with reliable evidence of exploitation and a clear fix. What qualifies, KEV versus CVE, and what a patch desk does with it.Also: KEV, CISA KEV, KEV catalog

N

N-day vulnerabilityAn n-day is a disclosed vulnerability with a vendor fix that attackers exploit on systems not yet updated. How it differs from a zero-day, and how a patch desk closes it.Also: n-day, n-day exploit

P

Patch TuesdayPatch Tuesday is Microsoft's monthly security release, on the second Tuesday at 10:00 AM Pacific. What it contains, how to triage it, and how it differs from OOB fixes.Also: Patch Tuesday, Update Tuesday, B week release, monthly security update

S

Software bill of materials (SBOM)An SBOM is a formal record of the components in a piece of software. What it must contain, CISA's 2026 minimum elements, and how it speeds the response to a new CVE.Also: SBOM, software bill of materials

V

Vulnerability Exploitability eXchange (VEX)VEX is a machine-readable advisory stating whether a product is affected by a known vulnerability. Its four statuses, how it pairs with an SBOM, and how to act on it.Also: VEX, VEX document, VEX statement

Z

Zero-day vulnerabilityA zero-day is a flaw attackers exploit before a fix is available. How NIST and the UK NCSC define it, how Microsoft flags it, and the first moves for a patch desk.Also: zero-day, 0-day, zero-day exploit, zero-day attack

A term missing or a definition that reads wrong? Request a correction. Longer explainers live in the guides.