CVE

CVE stands for Common Vulnerabilities and Exposures. The Cybersecurity and Infrastructure Security Agency (CISA) sponsors the program and MITRE operates it. A publicly disclosed flaw receives an ID, a short description, and links to advisories and fixes. The ID starts with CVE, then a year, then a number. That ID stays the name of the flaw when the description is updated.

A Unity editor version, a package, or a native plugin can have a published CVE. You use that ID to match a version you ship to the flaw, then apply the fix the advisory names.

A dependency scan reports a CVE on a package version in your project. You open that ID, confirm your version is in the affected range, and upgrade to a release the advisory marks as fixed. The scan, the advisory, and the pull request all cite the same ID.

• CISA

Common Vulnerabilities and Exposures