Post cover image

October 30, 2026

How to Find a Target for Your First CVE | Nidhi Kathayat

As a beginner, finding my first CVE was honestly hard. I was in the same phase 6 months ago. I had practiced a lot on web pentesting labs…

By Nidhi kathayat

2 min read

As a beginner, finding my first CVE was honestly hard. I was in the same phase 6 months ago. I had practiced a lot on web pentesting labs but I still couldn't get a CVE. The reason? I wasn't able to choose the right target. Before we get into that, let's cover the basics.

What is a CVE?

CVE stands for Common Vulnerabilities and Exposures. When a security bug is found in software, it gets a unique ID so everyone refers to that same bug by the same name. Think of it like an Aadhaar number, but for vulnerabilities. Example: CVE-2026–12345 -> CVE is the system name 2026 is the year 12345 is the unique bug number. MITRE runs the program, and CNAs (CVE Numbering Authorities) like GitHub, Google, Red Hat, and VulDB assign IDs.

Why does a CVE ID matter?

  • Public recognition: your name is credited permanently in the CVE record.
  • Career boost: real proof that you've worked on real-world software, not just labs.
  • Credibility: builds your image as a serious researcher.
  • Network: connects you with maintainers and other researchers.

Note: a CVE doesn't pay you. That's bug bounty, which is a different thing.

How to Find a Good Target

  1. Choose targets with fewer stars Fewer stars means less engagement and less competition.
None

2. Check the history of the target Look at past security advisories and CVEs. This will keep you away from duplicate findings.

None

Look at past security advisories and CVEs. They show which bug types keep repeating (like missing authorization in the screenshot below) and help you avoid duplicate reports.

3. Check for regular updates Look at GitHub advisories and commit history. Active projects keep adding features, and new features usually bring new bugs.

None

4. Use LinkedIn posts If a researcher found a CVE in a certain platform try to hunt in that same platform. (But don't copy professionals 😭 )

None

Bonus tips

  • Check for a SECURITY.md or a private way to report bugs.
  • Pick a project that's still maintained.
  • Choose a language you're comfortable reading.
  • Always test on your own local setup and report responsibly.

Final words

Don't get discouraged if you find nothing in the first few weeks. Pick the right target, stay consistent, and your first CVE will come.