CAN and CVE numbers are assigned to security-related vulnerabilities and bugs. CVE stands for Common Vulnerabilities and Exposures. It is not, as is traditionally assumed, a database but rather, a dictionary of terms. It provides a standardized list of names and definitions for vulnerabilities and exposures and a centralized language for defining vulnerabilities. CVE numbers are assigned to vulnerabilities, for example CVE-1999-0067.
CVE and CAN numbers were developed as a community effort and are managed by the MITRE Corporation. CANs are candidate CVE entries. Perhaps they have not yet been fully investigated or understood and, until this occurs, they are assigned CAN numbers rather than CVE numbers. You can read about this in more detail by clicking here.
This was first published in December 2005