Security and patching glossary: CVE, CVSS, KEV, EPSS and more

Updated November 2026

Short, plain definitions of the terms you meet in security advisories, scanner reports and incident write-ups. Where an official body defines a term, the definition below follows it, and the sources are listed at the end. Terms are grouped by topic; use your browser’s find function to jump to one.

Vulnerability IDs and scores

Vulnerability: A weakness in a product that can be exploited to harm confidentiality, integrity or availability, or a set of conditions that lets someone break a security policy. This is how the CVE Program defines it. Not every bug with a bad outcome counts.
CVE (Common Vulnerabilities and Exposures): The CVE Program is an international, community-driven effort to identify and catalog publicly disclosed vulnerabilities. Each one gets a CVE ID such as CVE-2024-6387, so vendors, scanners and admins can be sure they mean the same flaw.
CVE Record: The structured data published for a CVE ID: description, affected products and references. A record is Reserved (ID handed out, no details yet), Published, or Rejected (the ID should no longer be used).
CNA (CVE Numbering Authority): An organization authorized to assign CVE IDs and publish CVE Records within an agreed scope, usually its own products. Many Linux distributions and large open-source projects are CNAs, so the first CVE Record often comes from the vendor itself.
NVD (National Vulnerability Database): The US government repository of standards-based vulnerability management data, run by NIST. It holds data on software flaws, product names and impact metrics such as CVSS scores, keyed by CVE ID.
CVSS (Common Vulnerability Scoring System): A standard from FIRST that gives a vulnerability a score from 0.0 to 10.0, showing how severe it is compared with other vulnerabilities. It does not know your setup: a 9.8 in a service you do not run matters less than a 7.5 in your public web server.
CVSS v3.1 vs v4.0: CVSS v3.1 uses Base, Temporal and Environmental metric groups; v4.0 (first published in November 2023) uses Base, Threat, Environmental and Supplemental groups. Version 4.0 asks you to label which groups went into a score (CVSS-B, CVSS-BT, CVSS-BE or CVSS-BTE), and you will see both versions in advisories, so check which one you are reading.
Severity rating: The CVSS word scale: None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9) and Critical (9.0–10.0), the same in v3.1 and v4.0. Vendors also rate issues for their own builds (Red Hat, for example, uses Critical, Important, Moderate and Low), and their rating can differ from the score in the CVE Record.
KEV (Known Exploited Vulnerabilities catalog): CISA’s list of vulnerabilities with reliable evidence of active exploitation in the wild, a CVE ID and a clear fix such as a vendor update. Proof-of-concept code or scanning alone does not get a flaw listed. US federal civilian agencies are required to remediate listed flaws; for everyone else it is a strong signal to patch now.
EPSS (Exploit Prediction Scoring System): A daily score from 0 to 1, with a percentile, estimating the probability that a published CVE will be exploited in the wild in the next 30 days. It is maintained by the EPSS Special Interest Group at FIRST; use it alongside CVSS (how bad) and KEV (already exploited).
CWE (Common Weakness Enumeration): A community-developed list of common software and hardware weakness types, such as CWE-79 (cross-site scripting) or CWE-787 (out-of-bounds write). A CVE is one concrete flaw; its CWE names the kind of mistake behind it.

Flaws and exploits

Exploit: Code or a technique that takes advantage of a vulnerability to do something the attacker should not be able to do. A public, working exploit sharply shortens the time you have to patch.
Proof of concept (PoC): A demonstration that a flaw can be triggered, often published by researchers. A PoC is not proof of attacks in the wild, but it is often turned into a working exploit quickly.
Zero-day: A vulnerability attackers use before the vendor knows about it or before a fix exists. NIST defines a zero-day attack as one that exploits a previously unknown hardware, firmware or software vulnerability. Until a patch arrives, you can only reduce exposure (see firewall and hardening).
N-day: A vulnerability that is already public and usually already has a fix, but is still unpatched on some systems. Once a fix is out, attackers can study it to see what to target, so the gap between the release and your update matters.
RCE (remote code execution): A flaw that lets an attacker run their own commands on your server over the network. Pre-authentication RCE in an internet-facing service (no login needed) is the most urgent kind of bug to patch.
LPE (local privilege escalation): A flaw that lets a user or process already on the machine gain more rights, usually root. Attackers chain an LPE with a web-app or RCE bug, so “local only” does not mean “safe to wait” on shared or public-facing servers.
Privilege escalation: Any technique an attacker uses to gain higher-level permissions on a system or network, from exploiting a kernel bug to abusing a misconfigured sudo rule. MITRE ATT&CK lists it as its own attack stage.
Attack surface: The set of points on the boundary of a system where an attacker can try to get in, affect it or pull data out: open ports, web apps, logins, APIs. Fewer services and fewer open ports mean less to patch.
Denial of service (DoS, DDoS): An attack that makes a service unavailable by crashing it or flooding it with traffic; a DDoS uses many machines at once. See DDoS and floods.
Supply chain attack: Tampering with software, or the way it is delivered, before it reaches you: a poisoned package, a compromised build system or a hijacked update channel. Verified package signatures and an SBOM help you spot and scope it.

Fixes and support lifecycles

Patch: A fix for a piece of software. On Linux and Unix servers it normally arrives as an updated package from your distribution, installed with your package manager.
Upstream: The original project that writes the software (for example OpenSSH or nginx), as opposed to the distribution that packages it. Upstream release notes give upstream version numbers, which may not match your distribution’s package.
Backport: Taking a security fix from the newest upstream version and applying it to the older version a distribution ships. Your package can be fully fixed while its version number looks old, which is why version-only scanners raise false alarms; see Check installed versions.
LTS (long-term support): A release maintained with security fixes for longer than usual. Debian LTS extends each stable release to at least five years, run by volunteers and companies rather than the Debian Security Team; Ubuntu LTS releases get five years of standard security maintenance.
ESM (Expanded Security Maintenance): Canonical’s security maintenance for Ubuntu LTS releases, included with Ubuntu Pro. It continues fixes for the main repository after standard support ends and covers universe packages for ten years from release; with the Legacy add-on, coverage can reach 15 years. See Ubuntu.
ELS / ELTS (extended lifecycle support): A paid extension that keeps some security fixes coming after a release’s normal support ends. Examples are Freexian’s Debian ELTS, a commercial offering (not an official Debian project) that extends support to ten years in total, and Red Hat’s ELS add-on, which Red Hat says Extended Life Cycle Premium replaces from RHEL 8.10 onward.
EOL (end of life): The date after which a release gets no more security fixes. Red Hat, for example, says it provides no security fixes in the Extended Life Phase at the end of a RHEL life cycle. Running an EOL system means every new flaw stays open; see Is my OS supported? and End-of-life server.
Errata: Red Hat’s name for published updates: RHSA (security), RHBA (bug fix) and RHEA (enhancement). Other RHEL-family distributions use similar names.
Live patch: A fix applied to the running Linux kernel by redirecting calls from the faulty function to a fixed one, so critical issues are closed without a reboot. It covers selected fixes only; you still need regular reboots into a new kernel. See Kernel live patching.
Restart required: After a library or service update, programs that are already running keep using the old code in memory until they restart. Tools such as needrestart (Debian, Ubuntu) and dnf needs-restarting (RHEL family) list what to restart; see Restarts and reboots.
Automatic updates: Tools that install security updates on a schedule without an admin, such as unattended-upgrades on Debian and Ubuntu or dnf-automatic on RHEL-family systems. See Automatic updates.
Mitigation (workaround): A step that reduces risk without fixing the code: disabling a module, blocking a port, adding a WAF rule. Use it while you wait for a patch, then remove it once the fix is installed if it hurts functionality.

Advisories and data formats

Security advisory: A vendor’s notice that a flaw is fixed in its packages, naming the fixed versions. Examples: DSA (Debian Security Advisory, on debian-security-announce), DLA (Debian LTS advisory, on debian-lts-announce), USN (Ubuntu Security Notice, with RSS and Atom feeds) and RHSA (Red Hat security errata). See Security advisories.
SBOM (software bill of materials): A formal record of the components used to build a piece of software and how they relate, like a list of ingredients. With an SBOM you can answer “do we ship the affected library?” in minutes.
CSAF (Common Security Advisory Framework): An OASIS standard for publishing security advisories as machine-readable JSON, so tools can read them without scraping web pages. CSAF 2.0 defines profiles including Security Advisory and VEX.
VEX (Vulnerability Exploitability eXchange): A statement from a supplier saying whether a product is affected by a specific known vulnerability. A VEX “not affected” statement lets you close a scanner finding with evidence instead of guessing.
Vulnerability scanner: A tool that compares installed software (or what a service reveals over the network) with vulnerability data and reports likely issues. Treat findings as leads to verify: false positives are common when a distribution backported a fix without changing the upstream version number. See Vulnerability scanning.

Defenses and tools

Hardening: Reducing the ways a system can be attacked, which NIST describes as patching vulnerabilities and turning off nonessential services. In practice it also means safe defaults, tight permissions and removing unused software; see Server hardening.
Least privilege: The principle that each user, service and process gets only the access it needs to do its job. A web server that cannot write to its own code directory is much harder to turn into a web shell host.
MFA (multi-factor authentication): Authentication that needs two or more different kinds of factor, such as a password plus a hardware key or one-time code. Use it on control panels, hosting and cloud accounts, and VPNs.
SSH key authentication: Logging in with a key pair instead of a password, which defeats password guessing. Combine it with disabling password logins and direct root login; see SSH hardening.
Firewall: A filter that allows or blocks network traffic by port, protocol and address. On a server, the safe default is to block everything inbound except the services you mean to offer; see Firewall basics.
WAF (web application firewall): A filter in front of a web application that inspects HTTP requests and blocks common attack patterns such as SQL injection. It buys time but is a mitigation, not a fix; see Web attack monitoring.
IDS (intrusion detection system): Software that monitors network or system events, looks for suspicious activity and alerts administrators. Host-based IDS runs on the server; network IDS watches traffic. See Intrusion detection.
IPS (intrusion prevention system): A system that can detect intrusive activity and also try to stop it, ideally before it reaches its target, for example by dropping packets or blocking an address.
EDR (endpoint detection and response): Agent software on servers and workstations that records process, file and network activity, flags suspicious behavior and lets responders investigate or isolate the machine. It complements patching; it does not replace it.
File integrity monitoring (FIM): Recording checksums of important files and alerting when they change unexpectedly, which catches modified binaries, new web shells and edited configuration. See File integrity monitoring.

Attacks and attacker techniques

Ransomware: Malware that encrypts files so they and the systems that rely on them become unusable, followed by a demand for payment. Attackers often also steal data first and threaten to leak or sell it; see Ransomware.
Web shell: A script an attacker places on a web server that lets them run commands on the host through ordinary web requests. It is a common way to keep access after exploiting a web application; see Website hacked.
C2 (command and control): The channel attackers use to communicate with and control compromised systems, often disguised as normal web or DNS traffic. Unexpected outbound connections are a classic sign; see Process and network watch.
Persistence: Techniques attackers use to keep their foothold through reboots, password changes and other clean-up, such as cron jobs, systemd units, extra SSH keys or new accounts. See Find backdoors.
Backdoor: A hidden way back into a system that bypasses normal authentication, left by an attacker or planted in software. Patching the original hole does not remove a backdoor that is already there.
Lateral movement: Moving from one compromised machine to others on the same network, often with stolen SSH keys or passwords. Separate networks and unique credentials per host limit it.
Brute-force attack: Guessing passwords by trying many combinations, usually against SSH, mail or web logins. Key-only SSH and rate limiting stop it; see Brute-force attacks.
Credential stuffing: Trying username and password pairs leaked from other sites, betting that people reuse passwords. Unique passwords and MFA defeat it; see Leaked credentials.
Cryptojacking: Running cryptocurrency-mining software on someone else’s server without permission, usually after exploiting an unpatched service. Sustained high CPU from an unknown process is the usual sign; see Cryptominer.
IOC (indicator of compromise): A piece of evidence that a system has been breached: a known-bad file hash, IP address, domain, user account or log entry. Vendors and CERTs often publish IOCs with advisories for exploited flaws; see Signs of compromise.