CVE gave every software flaw one public ID, and the whole security industry speaks it

In the late 1990s security tools each had their own names for the same bugs, so an alert from one scanner could not be correlated with an advisory from a vendor or a database entry from another product. Information about a vulnerability was scattered under incompatible labels.

MITRE's David Mann and Steven Christey proposed a solution in a white paper, 'Towards a Common Enumeration of Vulnerabilities', presented at a Purdue workshop in January 1999. A working group — later the 19-member CVE Editorial Board — created the first 321 CVE entries, and the list was officially launched in September 1999.

The move was a naming layer, not a content monopoly: CVE deliberately stayed neutral about severity and details, letting vendors, researchers and tools keep their own descriptions while sharing one identifier. By December 2000, 29 organizations had declared 43 products CVE-compatible.

Adoption compounded. NIST's National Vulnerability Database is built around CVE entries; NIST guidance recommended the scheme; OWASP, Symantec and the trade press cite CVE IDs, and ITU-T adopted CVE as an international recommendation (X.1520). Naming became the common language of vulnerability management.