In more detail
The format is CVE-year-number. Having one shared name lets vendors, scanners and security teams talk about the same flaw. Entries are catalogued in the CVE programme and enriched with severity data in databases such as the US National Vulnerability Database. IDs are assigned by CVE Numbering Authorities (CNAs), which include large vendors, open-source foundations and national CERTs. The year is when the ID was reserved, not necessarily when the flaw was found or published, and the number has at least four digits but can be longer.
Why it matters
Patch notes, scanner reports and advisories all key on the CVE ID, so it is the quickest way to check whether a given update fixes a given problem. A CVE says only that a Vulnerability exists: its severity comes from a CVSS score, and whether you are actually exposed depends on your versions and configuration.
Example
CVE-2014-0160, "Heartbleed": a missing bounds check in the TLS heartbeat extension of OpenSSL 1.0.1 to 1.0.1f let an attacker read up to 64 KB of server memory per request, including private keys. OpenSSL 1.0.1g fixed it. Its CVSS v3 base vector, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, scores 7.5 (High). CVE-2021-44228 ("Log4Shell") is another well-known ID, scored the maximum 10.0.
Common confusion
A CVE is an identifier, a CVSS score is a severity rating, and a Zero-day is a flaw exploited before a fix exists; one vulnerability can have all three labels at once.