thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Commonly confused · Security Operations

CVE vs CVSS vs CWE: What's the Difference?

A CVE is a unique identifier for a specific publicly known vulnerability, CVSS is a scoring system that rates a vulnerability's severity from 0.0 to 10.0, and a CWE is a category of software weakness type that can lead to vulnerabilities.

CVECVSSCWE
What it isIdentifier for one vulnerabilitySeverity scoreWeakness category
ExampleCVE-2021-44228 (Log4Shell)10.0 CriticalCWE-79 (XSS), CWE-89 (SQL injection)
AnswersWhich specific flaw?How bad is it?What kind of mistake caused it?
Maintained byMITRE CVE Program, NVD enrichesFIRSTMITRE
Used forTracking and referencingPrioritizing remediationSecure coding and root-cause analysis
Remember it

CVE names it, CVSS rates it, CWE classifies it.

Exam tip

CySA+ often shows a CVSS vector string and asks you to interpret metrics like AV:N or PR:N. Remember CVSS measures severity, not risk to your specific environment.

Tested on

More Security Operations look-alikes