As the name suggests it, CVE are divided to two categories: Vulnerabilities and Exposures both are mainly errors in a given software code or its configuration that respectively may allow an attacker to -for example- gain a privilege escalation (running a code as root on a user level environment) or to gain an indirect access to a system/network.
Before trying (at least) to adresse your points, its important to keep in mind that the very first stage of creating a CVE is discovering and disclosing a vulnerability. And for the sake of simplicity :
- How do CVEs work?: Once a vulnerability is discovered and disclosed, CVE Numbering Authorities (CNA) assigns this vulnerability a CVE ID then post the CVE on the CVE List
- How do you find a CVE related to a particular product?: There are many repositories around, like the one suggested by @bonsaiviking, you can use https://cve.mitre.org/, https://www.cvedetails.com/ or https://nvd.nist.gov/...
- Where can I find a hotfix for a CVE?: Generally hot fixes are updates pushed by affected software vendors, this why its important to keep its Os, Softwares, Web browsers updated.
- Do all listed CVEs have hotfixes? To make it simple, the answer is NO, researchers and bug hunters usually respect what is called Vulnerability Disclosure Policy, to make it simple, a typical disclose starts by contacting the affected vendor and making it aware of the found vulnerability, by providing it a Proof of Concept for example and technical details, the vendor should correct the concerned vulnerability within 90 days passing this deadline, the vulnerability could be disclosed, IF t this happens, then the "bug" is assigned a CVE.
- What do I do if I can't find a hotfix for a listed CVE? In general, nothing except waiting an update from the vendor or avoiding the use of the affected software.
The answer was not exhaustive but hope it helped !
