Vulnerability.

A vulnerability is any flaw or weakness — in code, configuration, design, or operational practice — that, if exploited, could compromise the confidentiality, integrity, or availability of an information system. Vulnerabilities arise from software bugs (memory-safety errors, missing input validation), misconfiguration, weak or default credentials, insecure design, and unpatched dependencies.

Public vulnerabilities are catalogued with CVE identifiers by MITRE and enriched in NIST's National Vulnerability Database. Root-cause classes are described by CWE, severity is scored with CVSS — whose v4.0 revision was published by FIRST on 1 November 2023 — and the probability of exploitation in the near term is estimated by EPSS. Because scanners routinely surface thousands of findings, teams increasingly prioritise by real-world exploitation: CISA's Known Exploited Vulnerabilities (KEV) catalogue, mandated for U.S. federal agencies under Binding Operational Directive 22-01 (November 2021), lists flaws seen actively abused. Log4Shell (CVE-2021-44228, CVSS 10.0) showed how a single dependency vulnerability can expose millions of systems within hours of disclosure.

Managing vulnerabilities requires continuous discovery (scanning, SAST/DAST, SCA), risk-based prioritisation, patching or compensating controls, and verification that fixes are effective and durable across the full asset inventory.

flowchart LR
  A[Weakness introduced<br/>code / config / design] --> B[Discovery<br/>scan · SAST/DAST · disclosure]
  B --> C[Cataloguing<br/>CVE · CWE]
  C --> D[Prioritisation<br/>CVSS · EPSS · CISA KEV]
  D --> E{Exploitable?}
  E -->|Yes| F[Exploit / active abuse]
  E -->|Patch or mitigate| G[Remediation]
  F --> G
  G --> H[Verify fix &<br/>update inventory]