This article was accepted into the corpus but its outbound wikilinks were never NER-processed — typical at the deepest BFS hop or when the run's entity cap was reached. No expansion funnel to show.
| CVE (list) | |
|---|---|
| Name | CVE (list) |
| Developer | Mitre Corporation |
| Released | 1999 |
CVE (list) The CVE (list) is a catalog of publicly disclosed cybersecurity vulnerabilities and exposures maintained to provide a common identifier system for tracking flaws across tools, advisories, and research. It interlinks disclosure processes used by Mitre Corporation, National Institute of Standards and Technology, United States Department of Homeland Security, European Union Agency for Cybersecurity, and industry partners such as Microsoft, Google, Apple Inc., Cisco Systems, Oracle Corporation, and IBM. The list underpins vulnerability management workflows employed by vendors, researchers, standards bodies, and incident response teams worldwide, including actors in FIRST (organization), CERT Coordination Center, Center for Internet Security, Open Web Application Security Project, and Internet Engineering Task Force.
The CVE (list) provides unique identifiers that enable correlation among advisories from US-CERT, NIST National Vulnerability Database, Vendor Security Advisories, Exploit Database, SecurityFocus, CERT/CC, and academic literature from institutions such as Carnegie Mellon University, Massachusetts Institute of Technology, Stanford University, University of California, Berkeley, and Georgia Institute of Technology. It interfaces with standards and frameworks including Common Vulnerability Scoring System, Common Platform Enumeration, Supply Chain Levels for Software Artifacts, ISO/IEC 27001, NIST Cybersecurity Framework, and Center for Internet Security Controls. The list’s identifiers are cited in regulatory regimes and incident reporting from bodies like European Commission, Federal Trade Commission, Securities and Exchange Commission, Australian Signals Directorate, and Japan Computer Emergency Response Team.
Mitre operates the CVE Program in coordination with partners such as NIST, CISA, Department of Defense, ENISA, and international participants like CERT-EU, JPCERT/CC, US-CERT, CERT-In and national CSIRTs. Trusted parties—vendors such as Red Hat, Debian, Canonical (company), SUSE, VMware, Fortinet, Palo Alto Networks, Trend Micro, and McAfee—submit requests through designated channels, while academic researchers from University of Oxford, University of Cambridge, ETH Zurich, National University of Singapore, and Tsinghua University contribute disclosures. Governance includes advisory committees with representation from IEEE, IETF, ISO, and private sector consortia like Cloud Security Alliance and Linux Foundation.
Each CVE entry follows a standard identifier format originally defined by Mitre Corporation and adopted by NIST: a "CVE" prefix, year, and sequence number used by entities such as Microsoft Security Response Center, Google Project Zero, Mozilla Security Team, and Apple Security in advisories. Metadata fields map to data consumers like NVD, oss-sec, GitHub Security Advisories, GitLab Security, Red Hat Security Data, Debian Security Tracker, OpenBSD Security, and FreeBSD Security. The list links to CWE classifications maintained by MITRE Corporation and cross-references exploit records in repositories such as Metasploit Framework, Exploit Database, Packet Storm Security, and academic datasets from RAND Corporation and SANS Institute.
High-impact entries historically referenced include identifiers used in discussions of incidents involving Stuxnet, WannaCry, NotPetya, Equifax data breach, SolarWinds Orion compromise, Heartbleed, Shellshock, Spectre (security vulnerability), Meltdown (security vulnerability), Log4Shell, Apache Struts CVE, Drupalgeddon, BlueKeep, EternalBlue, PrintNightmare, KRACK, and CVE-2014-6271 style entries. Compilations and curated lists are maintained by organizations including MITRE’s CVE List, NVD Vulnerability Database, OWASP Top Ten, Cisco Talos Intelligence Group, FireEye Mandiant, Kaspersky Lab, Symantec Corporation, Trend Micro Research, F-Secure, Palo Alto Networks Unit 42, CrowdStrike Intelligence, Mandiant (company), ESET Research, SophosLabs, and Bitdefender.
Security operations centers at institutions including Amazon Web Services, Microsoft Azure, Google Cloud Platform, Alibaba Cloud, IBM Cloud, Oracle Cloud Infrastructure, and telecommunications providers such as AT&T, Verizon Communications, Deutsche Telekom, and NTT Communications ingest CVE data into tools like Splunk, Elastic (company), QRadar, Tenable, Qualys, Rapid7, OpenVAS, Nessus, Burp Suite, Wireshark, Metasploit Framework, Ansible, Puppet (software), Chef (software), and SaltStack. Integration enables patch management workflows coordinated with vendors like Microsoft, Apple Inc., Canonical (company), Red Hat, SUSE, VMware, Cisco Systems, and Juniper Networks and compliance reporting to auditors from Deloitte, PwC, KPMG, and Ernst & Young.
Critiques by researchers at University of Illinois Urbana–Champaign, University of Maryland, Columbia University, Princeton University, and think tanks such as Brookings Institution and RAND Corporation focus on delayed assignment, inconsistent description quality, and limited contextualization for supply chain vulnerabilities cited by SolarWinds Orion compromise and Log4Shell. Policy analysts at Electronic Frontier Foundation and Open Rights Group highlight disclosure coordination tensions involving vendors such as Microsoft and Oracle Corporation and government actors like NSA and GCHQ. Metrics-focused critiques reference scoring divergence between CVSS and actual exploit prevalence as studied by researchers at SANS Institute, CERT Coordination Center, and Carnegie Mellon University.
Regulatory and legal frameworks intersecting with CVE usage include reporting obligations under laws and directives such as European Union NIS Directive, General Data Protection Regulation, U.S. Cybersecurity Information Sharing Act, Federal Information Security Modernization Act, Cybersecurity Act of 2015, California Consumer Privacy Act, and national incident reporting regimes managed by authorities like CISA, ENISA, NCCIC, ANSSI, and CERT-FR. Intellectual property and liability discussions involve parties including Microsoft, Apple Inc., Google, Oracle Corporation, Red Hat, VMware, and cybersecurity vendors; courts and agencies such as United States Court of Appeals, European Court of Justice, and Federal Communications Commission have shaped obligations around disclosure timelines and vendor remediation responsibilities.
Category:Computer security lists