What is CVE?
A public identifier for a specific known vulnerability in a piece of software. A CVE is only a risk to you if it is actually reachable in your deployment.
CVE: A public identifier for a specific known vulnerability in a piece of software. A CVE is only a risk to you if it is actually reachable in your deployment.
In plain language
Each CVE is a catalogued, publicly-known vulnerability with an ID like CVE-2026-12345. Scanners love CVEs because version-matching is easy — but a long CVE list is mostly noise until someone confirms which ones are reachable and exploitable in your running system.
SuperPentest drives mature scanners (nuclei and others) to surface candidate CVEs, then verifies exploitability against the live target rather than trusting a version banner — separating the theoretical from the real.
A concrete example
A dependency scan lists 48 CVEs in your image. Most are in code paths you never call, or need local access you don’t expose. One, though, is in your public image-processing library and is reachable from an upload form — that is the one that matters. SuperPentest drives scanners to find candidates, then tests which are actually reachable against the running app.
Related
Want this tested on your app? Book a demo or read how findings are verified.