CVE
CVE (Common Vulnerabilities and Exposures) is a globally unified vulnerability identification system maintained by the American non-profit organization MITRE. The system assigns a unique identifier (formatted as CVE-year-number) to each publicly disclosed software or hardware security vulnerability, enabling security researchers, vendors, and users to reference and track specific vulnerabilities in a standardized manner. It constitutes a critical infrastructure for global cybersecurity information sharing and vulnerability management.
Core Facts
CVE is a global vulnerability identification system maintained by the U.S. MITRE Corporation and funded by the U.S. Department of Homeland Security; since its launch in 1999, it has catalogued more than 200,000 vulnerability entries.
Multiple academic studies in 2024 showed that models such as GPT-4 are able to identify certain types of software vulnerabilities in controlled environments, with efficiency approaching that of a junior security researcher.
The CVE (Common Vulnerabilities and Exposures) database is the world's most authoritative vulnerability numbering system, with new vulnerabilities being disclosed and recorded every day.
Timeline (last 90 days)
The release notes for this version do not mention any CVE or security issues.
CVE is a standardized identifier for publicly disclosed cybersecurity vulnerabilities, in a format such as CVE-2024-XXXXX.
Users can track patch status through the CVE database or vendor security advisories.
Prompt injection, jailbreaking, and data poisoning differ significantly from traditional software vulnerabilities (such as buffer overflows and SQL injection) in their causes and exploitability: they often have no stable patch boundaries, the same prompt behaves differently across model versions, and they are difficult to fully describe using the traditional CVE numbering system.
5,045 vulnerabilities were disclosed in January 2026, and by August it had become 10,740, doubling.
Vulnerabilities whose descriptions contain the phrase 'Linux Kernel' produced about 5,000 CVEs between January and August 2026, but the number observed to be exploited in the wild as zero-days was zero.
Actually exploited vulnerabilities account for only 0.23% of all disclosed vulnerabilities, roughly only 1 out of 431.
LSCBench contains 450 tasks derived from 150 real vulnerabilities, of which 115 come from public CVEs and 35 from Java applications written by security experts.
Current mainstream AI code review tools (such as the large language model-based CodeRabbit, Cursor Bugbot, etc.) typically adopt two technical approaches: training models to recognize code patterns in historical CVE and bug-fix commits, and using static analysis to assist LLMs in semantic reasoning.
Traceforce's open-source scanner MCP X-Ray has already discovered five MCP server vulnerabilities, all of which have been assigned CVE numbers.
30 more timeline events
All Facts (20)
CVE is a global vulnerability identification system maintained by the U.S. MITRE Corporation and funded by the U.S. Department of Homeland Security; since its launch in 1999, it has catalogued more than 200,000 vulnerability entries.
90%VerifiedMultiple academic studies in 2024 showed that models such as GPT-4 are able to identify certain types of software vulnerabilities in controlled environments, with efficiency approaching that of a junior security researcher.
85%VerifiedThe CVE (Common Vulnerabilities and Exposures) database is the world's most authoritative vulnerability numbering system, with new vulnerabilities being disclosed and recorded every day.
80%VerifiedThe number of new CVEs added to the NVD database each year has exceeded 25,000, reaching an all-time high in 2023.
65%UnverifiedAISI的评估采用多层次测试框架，参照CVE数据库中的真实案例，同时设计全新挑战场景测试模型泛化能力
85%Partially Verified2024 年 UIUC 的研究表明 GPT-4 能够自主利用已公开的漏洞进行攻击，成功率达 87%
65%Unverified每年约10万个CVE中仅有不到100个被确认为零日利用
65%UnverifiedThe CVE numbering system is maintained by MITRE Corporation, with the format CVE-year-sequence number.
60%UnverifiedThe release notes for this version do not mention any CVE or security issues.
50%UnverifiedCVE is a standardized identifier for publicly disclosed cybersecurity vulnerabilities, in a format such as CVE-2024-XXXXX.
50%UnverifiedUsers can track patch status through the CVE database or vendor security advisories.
50%UnverifiedPrompt injection, jailbreaking, and data poisoning differ significantly from traditional software vulnerabilities (such as buffer overflows and SQL injection) in their causes and exploitability: they often have no stable patch boundaries, the same prompt behaves differently across model versions, and they are difficult to fully describe using the traditional CVE numbering system.
50%UnverifiedVulnerabilities whose descriptions contain the phrase 'Linux Kernel' produced about 5,000 CVEs between January and August 2026, but the number observed to be exploited in the wild as zero-days was zero.
50%UnverifiedActually exploited vulnerabilities account for only 0.23% of all disclosed vulnerabilities, roughly only 1 out of 431.
50%Unverified5,045 vulnerabilities were disclosed in January 2026, and by August it had become 10,740, doubling.
50%UnverifiedLSCBench contains 450 tasks derived from 150 real vulnerabilities, of which 115 come from public CVEs and 35 from Java applications written by security experts.
50%UnverifiedCurrent mainstream AI code review tools (such as the large language model-based CodeRabbit, Cursor Bugbot, etc.) typically adopt two technical approaches: training models to recognize code patterns in historical CVE and bug-fix commits, and using static analysis to assist LLMs in semantic reasoning.
50%UnverifiedTraceforce's open-source scanner MCP X-Ray has already discovered five MCP server vulnerabilities, all of which have been assigned CVE numbers.
50%UnverifiedThe discussion of the ICQ vulnerability exposed the lack of vulnerability disclosure mechanisms at the time—no CVE numbers, no standardized vendor response window—and security researchers often could only publicize problems through mailing lists or forums.
50%UnverifiedCSO reported that Anthropic is preparing a GitHub security advisory and has applied for a CVE, but as of the public information there is still no CVE number.
50%