When a flaw is found in a piece of software and disclosed, it can be assigned a CVE identifier. That ID becomes the shared name used by vendors, scanners, advisories, and news, so you can tell whether the problem your tool reports is the same one a maintainer has fixed.
For your app, CVEs matter through your dependencies. Your framework, database driver, image library, and everything they pull in can each have known flaws. Audit tools compare your installed versions against these public records and tell you which packages are affected and which version fixes them.
A CVE listing does not automatically mean your app is exploitable, since the flaw may be in a feature you do not use, and severity scores describe the general case, not your setup. Still, treat high-severity findings in internet-facing code as urgent. Keep dependencies current, use a lockfile so updates are deliberate, turn on automatic alerts from your repository host, and read the advisory before deciding to upgrade or work around it.