CVE (Common Vulnerabilities and Exposures)
A CVE, short for Common Vulnerabilities and Exposures, is a public identifier for a specific, disclosed security vulnerability. Each CVE has an ID in the form CVE-YYYY-NNNNN (for example CVE-2026-55255), assigned through the MITRE-run CVE Program and its network of CVE Numbering Authorities. The identifier gives everyone a common reference for the same flaw across advisories, scanners, and patch notes. A CVE record describes the vulnerability and affected products. Separate systems such as CVSS and EPSS score how severe and how likely to be exploited it is.
How a CVE gets assigned
When a vulnerability is discovered, a CVE Numbering Authority (a vendor, a research group, or MITRE itself) reserves an identifier and later publishes a record with a description and the affected versions. The identifier is deliberately just a name, not a severity rating. Severity comes from the Common Vulnerability Scoring System (CVSS), exploitation likelihood comes from EPSS, and the CISA KEV Catalog flags the subset already exploited in the wild. Together these give a vulnerability a name, a severity, a probability, and an exploitation status.
Why CVEs matter for AI systems
AI platforms are assembled from open-source parts: inference servers, agent frameworks, retrieval libraries, and MCP servers. Each new CVE in that stack is a potential path into the AI request flow, and AI-specific components have produced a run of high-impact CVEs. DeepInspect does not remediate CVEs; patching is the platform team's job. Its contribution is visibility into the request path, the per-decision record of which identity sent traffic through which endpoint, so when a CVE lands on a component, responders can tell whether it sat in a live AI path and what moved through it.
Related reading
- AI Bug-Hunting Drove ~1,500 High-Severity CVEs in June 2026: Prioritizing the Patch Window
AI models are now finding software flaws at scale. Epoch AI counted roughly 1,500 high-severity and critical CVEs reported in June 2026, about 3.5x the previous monthly record, while real exploitation still arrives within hours of disclosure. This walks through why patch prioritization by exploitability, plus identity-bound inline policy at the AI request boundary, is the control that holds between disclosure and patch.
- EPSS and KEV Patch Prioritization for the AI Stack: A Working Guide
CVSS severity alone tells you a vulnerability is bad, not whether it is being exploited. This guide shows how to combine the FIRST EPSS exploitation probability score with the CISA Known Exploited Vulnerabilities catalog to rank patch work across your AI inference stack, with a scoring rule, a worked example on real 2026 AI-tool CVEs, and an honest line on what patch prioritization does and does not cover.