Each vulnerability must have one record in the CVE list. There are certain criteria to be satisfied to assign a CVE ID to a vulnerability: The vulnerability should have a negative impact on security. The vulnerability can be fixed independently.