Common Vulnerabilities and Exposures (CVE)
: A standardized system for identifying and cataloging publicly known security vulnerabilities. Each CVE entry has a unique identifier (e.g., CVE-2024-12345), a description, severity rating, and references. Maintained by MITRE Corporation, the CVE system enables consistent communication about vulnerabilities across tools, vendors, and organizations.
Why It Matters for AI-Coded Apps
Every dependency in an AI-generated project may have CVEs. When an LLM generates code that imports a library, it does not check the CVE database for known vulnerabilities in that version. SCA tools map your dependency tree against CVE databases to flag these risks automatically.
Real-World Example
CVE-2021-44228 (Log4Shell) affected the Log4j Java logging library used by millions of applications. Any AI-generated Java project that included Log4j 2.x before version 2.17.0 was vulnerable to remote code execution. SCA tools that track CVEs flagged this immediately; projects without SCA remained vulnerable.
How to Detect and Prevent It
Run SCA tools that check dependencies against CVE databases. Subscribe to security advisories for your critical dependencies. Use Dependabot or Renovate for automated dependency updates. Regularly audit your SBOM against the National Vulnerability Database (NVD). Prioritize fixes by CVSS score and exploitability.
Frequently Asked Questions
How are CVE IDs assigned?
CVE IDs are assigned by CVE Numbering Authorities (CNAs) – organizations authorized by MITRE to assign identifiers. Major CNAs include MITRE, Google, Microsoft, Red Hat, and GitHub. Anyone can request a CVE through the CVE website or through a relevant CNA.
What is the difference between CVE and CWE?
CVE identifies specific vulnerability instances (e.g., a particular SQL injection in Log4j version 2.14). CWE categorizes types of vulnerabilities (e.g., CWE-89 describes SQL injection as a class of vulnerability). CVE is a specific bug; CWE is the bug category.
How many CVEs are published each year?
Over 25,000 CVEs were published in 2025, and the rate is accelerating. AI-generated code increases the attack surface because LLMs generate code using patterns from their training data, which may include vulnerable library versions and deprecated APIs.
Scan your app for security issues automatically
Vibe Eval checks for 200+ vulnerabilities in AI-generated code.
Try Vibe Eval