> For the complete documentation index, see [llms.txt](https://breachtrace.gitbook.io/vulnkeeper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breachtrace.gitbook.io/vulnkeeper/chapter-a/02-2-canonical-vulnerability-identifiers-cve-records-and-schemas.md).

# 2. Canonical vulnerability identifiers, CVE records & schemas

## 2.1 CVE Program - canonical CVE identity

<table><thead><tr><th width="89.12109375" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>CVE.org</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.cve.org/">www.cve.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Official CVE program portal for CVE IDs, CNA/ADP governance, CVE lookup, &#x26; program documentation.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Canonical governance source, but not always the richest technical source for scoring, affected versions, or exploitability.</td></tr><tr><td align="right">2</td><td><strong>CVE List v5 - official GitHub mirror/cache</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/CVEProject/cvelistV5">github.com/CVEProject/cvelistV5</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Primary public GitHub cache of CVE v5 JSON records. Useful for local mirroring, batch parsing, &#x26; canonical CVE field extraction.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Records may vary in completeness by CNA. Use with NVD, OSV, vendor advisories, &#x26; CISA Vulnrichment for enrichment.</td></tr><tr><td align="right">3</td><td><strong>CVE Record Format schema - direct JSON schema</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/CVEProject/cve-schema/blob/main/schema/CVE_Record_Format.json">github.com/CVEProject/cve-schema/blob/main/schema/CVE_Record_Format.json</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Machine-validation schema for CVE v5 records. Required for parser validation &#x26; ingestion guardrails.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Schema correctness does not imply record semantic completeness. Validate schema &#x26; still handle missing CNA fields.</td></tr><tr><td align="right">4</td><td><strong>CVE schema repository</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/CVEProject/cve-schema">github.com/CVEProject/cve-schema</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Contains schema versions, tests, examples, release history, &#x26; format evolution.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Track schema version drift when maintaining long-lived ingestion pipelines.</td></tr><tr><td align="right">5</td><td><strong>CVE Services API / CVE Program API</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://cveawg.mitre.org/api-docs/">cveawg.mitre.org/api-docs</a><br><br><strong><code>Access / Cost</code>:</strong> Free public docs; API workflows may require role/account for CNA functions</td><td><strong><code>Relevance</code>:</strong> Direct CVE lookup &#x26; CVE Services API documentation. Useful for targeted lookup workflows.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> API usage may differ from GitHub mirror sync behavior. Use for lookup, not necessarily full mirroring.</td></tr><tr><td align="right">6</td><td><strong>CVE Authorized Data Publishers - ADPs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.cve.org/ProgramOrganization/ADPs">www.cve.org/ProgramOrganization/ADPs</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Lists ADPs that can enrich CVE records beyond CNA-provided content.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> ADP enrichment can add critical assessment context. Treat ADP data as enrichment layered on top of canonical CNA data.</td></tr><tr><td align="right">7</td><td><strong>CISA Vulnrichment - CVE ADP enrichment</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/cisagov/vulnrichment">github.com/cisagov/vulnrichment</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Provides CISA ADP enrichment of CVE records, including SSVC decision points, &#x26; sometimes CWE/CVSS details.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for prioritization. Coverage may not be universal across all CVEs. Track freshness &#x26; missing enrichment states.</td></tr></tbody></table>

## 2.2 NVD - CVE enrichment, CPE matching, CVSS & configurations

<table><thead><tr><th width="91.61328125" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>NVD home</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://nvd.nist.gov/">nvd.nist.gov</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> U.S. government vulnerability-management repository. Provides vulnerability metadata, scoring, product mapping, &#x26; references.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> NVD enrichment may lag behind CVE publication or vendor disclosures. Monitor modified dates.</td></tr><tr><td align="right">2</td><td><strong>NVD CVE API 2.0</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://nvd.nist.gov/developers/vulnerabilities">nvd.nist.gov/developers/vulnerabilities</a><br><br><strong><code>Access / Cost</code>:</strong> Free public; optional free API key for higher rate limits</td><td><strong><code>Relevance</code>:</strong> Retrieves CVEs with CVSS, weaknesses, references, CPE configurations, &#x26; change history.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Central for CPE-based product matching. Rate limits &#x26; API keys may affect ingestion design.</td></tr><tr><td align="right">3</td><td>NVD CPE API 2.0</td><td><a href="https://nvd.nist.gov/developers/products">nvd.nist.gov/developers/products</a></td></tr><tr><td align="right">4</td><td>NVD Data Feeds</td><td><a href="https://nvd.nist.gov/vuln/data-feeds">nvd.nist.gov/vuln/data-feeds</a></td></tr><tr><td align="right">5</td><td>NVD CVSS resources</td><td><a href="https://nvd.nist.gov/vuln-metrics/cvss">nvd.nist.gov/vuln-metrics/cvss</a></td></tr><tr><td align="right">6</td><td>NVD CPE Dictionary</td><td><a href="https://nvd.nist.gov/products/cpe">nvd.nist.gov/products/cpe</a></td></tr><tr><td align="right">7</td><td>NVD API documentation root</td><td><a href="https://nvd.nist.gov/developers">nvd.nist.gov/developers</a></td></tr><tr><td align="right">8</td><td>NVD CVE Change History API</td><td><a href="https://nvd.nist.gov/developers/vulnerabilities">nvd.nist.gov/developers/vulnerabilities</a></td></tr></tbody></table>

## 2.3 Optional CVE meta-mirrors / commercial-community enrichments

These are useful as secondary sources, not canonical replacements.

<table><thead><tr><th width="91.63671875" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>VulnCheck NVD++</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.vulncheck.com/nvd2">www.vulncheck.com/nvd2</a><br><br><strong><code>Access / Cost</code>:</strong> Commercial; limited free/public info may exist</td><td><strong><code>Relevance</code>:</strong> Aggregated vulnerability intelligence that can supplement CVE/NVD/KEV workflows.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Commercial/community enrichment. Validate terms, licensing, API access, &#x26; provenance before production use.</td></tr><tr><td align="right">2</td><td><strong>Vulners</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://vulners.com/">vulners.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free web search; API/advanced features may require paid plan</td><td><strong><code>Relevance</code>:</strong> Vulnerability intelligence aggregator across many advisory &#x26; exploit sources.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for broad search &#x26; enrichment. Do not treat as canonical without source provenance.</td></tr><tr><td align="right">3</td><td><strong>OpenCVE</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.opencve.io/">www.opencve.io</a><br><br><strong><code>Access / Cost</code>:</strong> Free tier / paid plans</td><td><strong><code>Relevance</code>:</strong> CVE monitoring, subscriptions, change tracking, &#x26; alerting workflows.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for monitoring, but canonical ingestion should still pull from upstream CVE/NVD/vendor feeds.</td></tr><tr><td align="right">4</td><td><strong>CIRCL Vulnerability-Lookup / CVE Search</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://cve.circl.lu/">cve.circl.lu</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> CVE search &#x26; enrichment source, historically useful for threat-intel workflows.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Validate freshness before relying on it. Prefer canonical sources for production scoring.</td></tr><tr><td align="right">5</td><td><strong>Vulnerability-Lookup GitHub repository</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/vulnerability-lookup/vulnerability-lookup">github.com/vulnerability-lookup/vulnerability-lookup</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Correlates vulnerabilities from multiple sources independent of vulnerability IDs &#x26; supports coordinated vulnerability disclosure workflows.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful as a CVE/vulnerability correlation platform. Treat as a secondary aggregation/enrichment source, not canonical truth.</td></tr></tbody></table>

## 2.4 CVE Program governance, project repos, working groups & SADP

<table><thead><tr><th width="91.34765625" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>CVEProject GitHub organization</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/CVEProject">github.com/CVEProject</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub org</td><td><strong><code>Relevance</code>:</strong> Source organization for CVE schema, CVE list mirror, automation working group material, &#x26; related program repos.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for tracking official repository structure &#x26; project-level changes.</td></tr><tr><td align="right">2</td><td><strong>CVE Program Working Groups</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.cve.org/programorganization/workinggroups">www.cve.org/programorganization/workinggroups</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Official CVE Working Group listing.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Governance/process context, not a vulnerability feed.</td></tr><tr><td align="right">3</td><td><strong>CVE/CWE Programs groups.io main page</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://cve-cwe-programs.groups.io/g/main">cve-cwe-programs.groups.io/g/main</a><br><br><strong><code>Access / Cost</code>:</strong> Public/registration may vary by list</td><td><strong><code>Relevance</code>:</strong> Community list hub for CVE/CWE program discussions.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use for process context, community discussions, &#x26; WG announcements.</td></tr><tr><td align="right">4</td><td><strong>CVE/CWE Programs groups.io subgroups</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://cve-cwe-programs.groups.io/g/main/subgroups">cve-cwe-programs.groups.io/g/main/subgroups</a><br><br><strong><code>Access / Cost</code>:</strong> Public/registration may vary by list</td><td><strong><code>Relevance</code>:</strong> Subgroup listing for program working groups.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for discovering WG-specific list URLs.</td></tr><tr><td align="right">5</td><td><strong>CVE Consumer Working Group</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://cve-cwe-programs.groups.io/g/ConsumerWG">cve-cwe-programs.groups.io/g/ConsumerWG</a><br><br><strong><code>Access / Cost</code>:</strong> Public/registration may vary by list</td><td><strong><code>Relevance</code>:</strong> CVE consumer feedback, use cases, &#x26; schema/process discussions.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Important for consumer-oriented CVE metadata requirements.</td></tr><tr><td align="right">6</td><td><strong>CVE Automation Working Group repo</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/CVEProject/automation-working-group">github.com/CVEProject/automation-working-group</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Automation WG materials, workflows, &#x26; implementation discussion artifacts.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for automation requirements around CVE publication &#x26; ingestion.</td></tr><tr><td align="right">7</td><td><strong>CVE Automation Working Group list</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://cve-cwe-programs.groups.io/g/AWG">cve-cwe-programs.groups.io/g/AWG</a><br><br><strong><code>Access / Cost</code>:</strong> Public/registration may vary by list</td><td><strong><code>Relevance</code>:</strong> Automation WG mailing list.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for process &#x26; tooling evolution tracking.</td></tr><tr><td align="right">8</td><td><strong>CVEProject SADP pilot</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/CVEProject/sadp-pilot">github.com/CVEProject/sadp-pilot</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Supplemental ADP/SADP pilot data &#x26; artifacts.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for tracking supplemental vulnerability enrichment experiments.</td></tr><tr><td align="right">9</td><td><strong>Published SADP Records</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/CVEProject/sadp-pilot/tree/main/Published%20SADP%20Records">github.com/CVEProject/sadp-pilot/tree/main/Published%20SADP%20Records</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo path</td><td><strong><code>Relevance</code>:</strong> Published SADP record corpus.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Machine-readable/source-record context should be validated before ingestion.</td></tr><tr><td align="right">10</td><td><strong>RogoLabs SADP Tracker</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://rogolabs.github.io/SADP-Tracker">rogolabs.github.io/SADP-Tracker</a><br><br><strong><code>Access / Cost</code>:</strong> Public site; manually revalidate</td><td><strong><code>Relevance</code>:</strong> Community tracker for SADP material.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Add to link-check allowlist until manually verified.</td></tr><tr><td align="right">11</td><td><strong>CWE Working Groups &#x26; SIGs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://cwe.mitre.org/community/working_groups.html">cwe.mitre.org/community/working_groups.html</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> CWE working group &#x26; SIG context.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Important for weakness taxonomy evolution, including AI/ML-related CWE work.</td></tr><tr><td align="right">12</td><td><strong>CVE Services source repository</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/CVEProject/cve-services">github.com/CVEProject/cve-services</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Source repository for the CVE Services API.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for understanding CVE API implementation behavior, endpoint evolution, &#x26; service-side validation semantics.</td></tr></tbody></table>

## 2.5 Free CVE lifecycle data feeds, APIs & endpoint references

<table><thead><tr><th width="88.87890625" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>CVE Services API - OpenAPI &#x26; public CVE record lookup</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://cveawg.mitre.org/api-docs/">CVE Services API docs</a>, <a href="https://cveawg.mitre.org/api-docs/openapi.json">OpenAPI JSON</a>, <a href="https://cveawg.mitre.org/api">CVE Services base API</a><br><br><strong><code>Access / Cost</code>:</strong> Free public API docs; most write/assignment endpoints require CVE Services credentials; public record lookup is documented as accessible to all.</td><td><strong><code>Relevance</code>:</strong> Official lifecycle API surface for CVE ID lookup, CVE record retrieval, CVE reservation, submission, updates, &#x26; CNA/Secretariat workflows.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Primary endpoint family to document: <code>/api/cve/{id}</code> for CVE record lookup, <code>/api/cve-id</code> for CVE ID workflows, &#x26; authenticated CNA/Secretariat endpoints for reserve/submit/update operations.</td></tr><tr><td align="right">2</td><td><strong>CVE Partner List - Root CNAs, CNAs &#x26; CNA scope discovery</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.cve.org/PartnerInformation/ListofPartners">CVE Partner List</a><br><br><strong><code>Access / Cost</code>:</strong> Free public web listing; JavaScript rendering/manual review may be needed for automation.</td><td><strong><code>Relevance</code>:</strong> Authoritative source for current CVE Program partners, CNA scope boundaries, Root CNAs, &#x26; CNA status verification.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use to verify CNA status before marking OpenAI, Cloudflare, CrowdStrike, or any vendor as a confirmed CNA. Treat as manual-review source in link-check CI.</td></tr><tr><td align="right">3</td><td><strong>CVE Program CNA Rules &#x26; program process resources</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.cve.org/ResourcesSupport/AllResources/CNARules">CVE Program CNA Rules</a>, <a href="https://www.cve.org/AllResources/CveServices">CVE Services overview</a><br><br><strong><code>Access / Cost</code>:</strong> Free public CVE Program documentation.</td><td><strong><code>Relevance</code>:</strong> Defines CNA responsibilities, CVE assignment behavior, record publication expectations, &#x26; lifecycle governance rules.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use as policy source for CVE reservation, publication, rejection, record updates, scope boundaries, &#x26; quality requirements.</td></tr><tr><td align="right">4</td><td><strong>Google Root CNA / Google Bug Hunters VRP</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://bughunters.google.com/">Google Bug Hunters</a>, <a href="https://about.google/appsecurity/">Google Product Security</a>, <a href="https://www.cve.org/PartnerInformation/ListofPartners">CVE Partner List</a><br><br><strong><code>Access / Cost</code>:</strong> Free public program pages; CNA role should be verified against the live CVE partner list.</td><td><strong><code>Relevance</code>:</strong> Google Root CNA / disclosure path for Google, Android, Chrome, Cloud, AI, &#x26; ecosystem issues.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Keep distinct from Project Zero, Android bulletins, Chrome release posts, Google Cloud bulletins, &#x26; OSV.</td></tr><tr><td align="right">5</td><td><strong>INCIBE-CERT Root CNA / Spanish vulnerability coordination</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.incibe.es/en/incibe-cert">INCIBE-CERT</a>, <a href="https://www.incibe.es/en/incibe-cert/early-warning/security-advisories">INCIBE advisories</a>, <a href="https://www.cve.org/PartnerInformation/ListofPartners">CVE Partner List</a><br><br><strong><code>Access / Cost</code>:</strong> Free public web access; some materials may require Spanish/English page handling.</td><td><strong><code>Relevance</code>:</strong> Root CNA / national coordination source relevant to European &#x26; Spanish vulnerability coordination.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Add to CVE governance because CVE Services docs name INCIBE as a Root CNA credential-routing option.</td></tr><tr><td align="right">6</td><td><strong>JPCERT/CC Root CNA, JVN &#x26; MyJVN feeds</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.jpcert.or.jp/english/">JPCERT/CC English</a>, <a href="https://jvn.jp/en/">JVN English</a>, <a href="https://jvn.jp/en/rss/jvn.rdf">JVN English RSS</a>, <a href="https://jvndb.jvn.jp/apis/myjvn/">MyJVN API</a><br><br><strong><code>Access / Cost</code>:</strong> Free public web/RSS/API documentation; API query construction requires MyJVN parameters.</td><td><strong><code>Relevance</code>:</strong> Root CNA / Japan vulnerability coordination source, including Japanese Vulnerability Notes &#x26; JVN iPedia-style data access.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for Asia/Japan disclosure context, multi-vendor coordination, JVN identifiers, &#x26; CVE cross-reference workflows.</td></tr><tr><td align="right">7</td><td><strong>Linux Kernel CNA &#x26; linux-cve-announce archive</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://lore.kernel.org/linux-cve-announce/">linux-cve-announce archive</a>, <a href="https://docs.kernel.org/process/security-bugs.html">Linux kernel security docs</a>, <a href="https://www.kernel.org/">kernel.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free public mailing-list archive &#x26; documentation.</td><td><strong><code>Relevance</code>:</strong> Kernel-specific CVE assignment, disclosure, patch-flow, &#x26; affectedness context.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Track separately from Red Hat, Debian, Ubuntu, SUSE, Amazon Linux, Android, &#x26; other downstream distro advisories because distro backports can differ from upstream kernel status.</td></tr><tr><td align="right">8</td><td><strong>CERT/CC Vulnerability Notes &#x26; RSS</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.kb.cert.org/vuls/">CERT/CC VULS</a>, <a href="https://www.kb.cert.org/vuls/rss">CERT/CC VULS RSS</a><br><br><strong><code>Access / Cost</code>:</strong> Free public web/RSS access; RSS endpoint should be kept in manual-review allowlist if fetcher blocks it.</td><td><strong><code>Relevance</code>:</strong> CVD coordination, multi-vendor vulnerability notes, affected-vendor status, &#x26; remediation guidance.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Add as CNA/coordinator lifecycle source, not only exploit/disclosure context.</td></tr><tr><td align="right">9</td><td><strong>Microsoft MSRC Security Update Guide / CVRF API</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://msrc.microsoft.com/update-guide">MSRC Update Guide</a>, <a href="https://api.msrc.microsoft.com/cvrf/v3.0/updates">MSRC CVRF updates API</a>, <a href="https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2025-Mar">MSRC CVRF document example</a><br><br><strong><code>Access / Cost</code>:</strong> Free public web/API access; rate limits &#x26; versioned document IDs should be handled by ingestion jobs.</td><td><strong><code>Relevance</code>:</strong> Microsoft CNA/product-security source for Microsoft CVEs, affected products, KBs, severity, CVRF-style update metadata, &#x26; remediation references.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use <code>/updates</code> to discover release document IDs, then fetch specific CVRF documents such as <code>/cvrf/{documentId}</code> for detailed security update metadata.</td></tr><tr><td align="right">10</td><td><strong>Microsoft Defender Vulnerability Management - list vulnerabilities API</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://learn.microsoft.com/en-us/defender-endpoint/api/get-all-vulnerabilities">List vulnerabilities docs</a>, <a href="https://api.security.microsoft.com/api/Vulnerabilities">Vulnerabilities endpoint</a><br><br><strong><code>Access / Cost</code>:</strong> Requires Microsoft Defender for Endpoint/Defender Vulnerability Management permissions &#x26; bearer token.</td><td><strong><code>Relevance</code>:</strong> Asset-aware vulnerability inventory endpoint with CVE ID, CVSS, exploit flags, exposed machines, EPSS, status, &#x26; dates.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use as enterprise exposure overlay rather than canonical global vulnerability truth.</td></tr><tr><td align="right">11</td><td><strong>Microsoft Defender Vulnerability Management - per-device software vulnerabilities export</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://learn.microsoft.com/en-us/defender-endpoint/api/get-assessment-software-vulnerabilities">Export software vulnerabilities assessment docs</a>, <a href="https://api.security.microsoft.com/api/machines/SoftwareVulnerabilitiesByMachine">SoftwareVulnerabilitiesByMachine endpoint</a><br><br><strong><code>Access / Cost</code>:</strong> Requires Defender API permissions; supports JSON response &#x26; via-file export patterns.</td><td><strong><code>Relevance</code>:</strong> Maps CVEs to device, software vendor/name/version, OS platform, exploitability level, first/last seen timestamps, &#x26; available security updates.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Best for exposure/affectedness correlation inside an organization. Save snapshots for history because current exports may not preserve historical state.</td></tr><tr><td align="right">12</td><td><strong>Cisco PSIRT openVuln API</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://developer.cisco.com/docs/psirt/">Cisco PSIRT openVuln API docs</a>, <a href="https://sec.cloudapps.cisco.com/security/center/publicationListing.x">Cisco Security Advisories</a><br><br><strong><code>Access / Cost</code>:</strong> Free docs; API use may require Cisco developer/auth workflow depending on endpoint &#x26; volume.</td><td><strong><code>Relevance</code>:</strong> Machine-consumable Cisco vulnerability advisories, queryable by advisory ID, CVE ID, bug ID, product type, software version, &#x26; timeframe.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Cisco docs state JSON/XML output &#x26; location data for CVRF/CSAF retrieval. Prefer CSAF where available.</td></tr><tr><td align="right">13</td><td><strong>Cloudflare security disclosure, security.txt &#x26; public security research feed</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.cloudflare.com/.well-known/security.txt">Cloudflare security.txt</a>, <a href="https://www.cloudflare.com/disclosure/">Cloudflare security policy</a>, <a href="https://blog.cloudflare.com/tag/security/rss/">Cloudflare security-tag RSS</a><br><br><strong><code>Access / Cost</code>:</strong> Free public web/RSS; no dedicated public CVE advisory API confirmed in this pass.</td><td><strong><code>Relevance</code>:</strong> Cloudflare product/security disclosure path &#x26; security research stream for edge, WAF, DNS, CDN, Workers, Zero Trust, &#x26; cloud/network service vulnerability context.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Treat as disclosure/research feed, not canonical CVE data unless a Cloudflare CVE/advisory record is explicitly published.</td></tr><tr><td align="right">14</td><td><strong>CrowdStrike public research feed &#x26; Falcon Spotlight vulnerability data - restricted</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.crowdstrike.com/en-us/blog/feed/">CrowdStrike blog feed</a>, <a href="https://www.crowdstrike.com/en-us/blog/">CrowdStrike blog</a>, <a href="https://falconpy.io/">FalconPy docs</a><br><br><strong><code>Access / Cost</code>:</strong> Public blog/RSS; Falcon platform vulnerability/Spotlight APIs are authenticated/commercial &#x26; not a free public CVE feed.</td><td><strong><code>Relevance</code>:</strong> Threat-intel, exploitability, adversary, &#x26; enterprise vulnerability-management context; useful for prioritization &#x26; exploitation signals.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Do not list CrowdStrike as a free canonical CVE data feed unless a specific public API/feed is verified.</td></tr><tr><td align="right">15</td><td><strong>Zero Day Initiative - published &#x26; upcoming advisories</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.zerodayinitiative.com/advisories/published/">ZDI published advisories</a>, <a href="https://www.zerodayinitiative.com/advisories/upcoming/">ZDI upcoming advisories</a>, <a href="https://www.zerodayinitiative.com/rss/published/">ZDI published RSS</a><br><br><strong><code>Access / Cost</code>:</strong> Free public web/RSS.</td><td><strong><code>Relevance</code>:</strong> Pre-disclosure &#x26; published vulnerability coordination, exploitability context, vendor disclosure timelines, &#x26; ZDI identifiers.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for tracking vulnerabilities before or around CVE publication. Cross-reference with CVE/NVD/vendor records after publication.</td></tr><tr><td align="right">16</td><td><strong>Openwall oss-security mailing list &#x26; RSS</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.openwall.com/lists/oss-security/">oss-security archive</a>, <a href="https://www.openwall.com/lists/oss-security/rss">oss-security RSS</a><br><br><strong><code>Access / Cost</code>:</strong> Free public mailing-list archive/RSS.</td><td><strong><code>Relevance</code>:</strong> Open-source vulnerability disclosure, CVE requests, embargo release coordination, &#x26; early technical discussion.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> High-signal source for OSS CVE lifecycle events. Requires deduplication &#x26; careful parsing of threads.</td></tr><tr><td align="right">17</td><td><strong>Full Disclosure / SecLists CVE-adjacent disclosure feed</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://seclists.org/fulldisclosure/">Full Disclosure archive</a>, <a href="https://seclists.org/rss/fulldisclosure.rss">Full Disclosure RSS</a><br><br><strong><code>Access / Cost</code>:</strong> Free public mailing-list archive/RSS.</td><td><strong><code>Relevance</code>:</strong> Public vulnerability disclosures, exploit announcements, advisories, &#x26; researcher/vendor coordination context.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Quality varies. Treat as disclosure signal, not canonical source of affectedness or remediation truth.</td></tr><tr><td align="right">18</td><td><strong>HackerOne disclosure platform &#x26; disclosed reports</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://hackerone.com/hacktivity">HackerOne Hacktivity</a>, <a href="https://hackerone.com/directory/programs">HackerOne directory</a><br><br><strong><code>Access / Cost</code>:</strong> Free public disclosed-report browsing; APIs &#x26; program details may require account or platform access.</td><td><strong><code>Relevance</code>:</strong> Bug bounty/CVD pipeline source where vulnerabilities can be reported, triaged, disclosed, &#x26; sometimes mapped to CVEs.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use for lifecycle/disclosure evidence; do not treat every report as CVE-backed or vendor-confirmed without validation.</td></tr><tr><td align="right">19</td><td><strong>Bugcrowd disclosure platform, VRT &#x26; program pages</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://bugcrowd.com/vulnerability-rating-taxonomy/">Bugcrowd vulnerability rating taxonomy</a>, <a href="https://bugcrowd.com/programs">Bugcrowd programs</a><br><br><strong><code>Access / Cost</code>:</strong> Free public taxonomy/program pages; submissions &#x26; details may require account or program access.</td><td><strong><code>Relevance</code>:</strong> Bug bounty/CVD triage context &#x26; severity normalization for researcher-submitted findings.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for report-quality &#x26; severity context. Not a canonical CVE feed.</td></tr><tr><td align="right">20</td><td><strong>OpenAI security &#x26; bug bounty program</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://openai.com/security-and-privacy/">OpenAI security &#x26; privacy</a>, <a href="https://openai.com/index/bug-bounty-program/">OpenAI bug bounty announcement</a>, <a href="https://bugcrowd.com/openai">OpenAI Bugcrowd program</a><br><br><strong><code>Access / Cost</code>:</strong> Free public security page; Bugcrowd submission workflow; bounty scope/rules apply.</td><td><strong><code>Relevance</code>:</strong> AI platform/product vulnerability disclosure path for OpenAI products, APIs, model-serving systems, &#x26; AI security issues.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Add as AI-vendor security/disclosure coverage. Do not mark as confirmed CNA unless verified against the current CVE partner list.</td></tr><tr><td align="right">21</td><td><strong>GitLab Advisory Database &#x26; community advisories</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://advisories.gitlab.com/">GitLab Advisory Database</a>, <a href="https://gitlab.com/gitlab-org/advisories-community">GitLab advisories-community repo</a><br><br><strong><code>Access / Cost</code>:</strong> Free public web/repository access.</td><td><strong><code>Relevance</code>:</strong> Package ecosystem advisories, CVE/GHSA/package aliasing, &#x26; GitLab security intelligence data.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Add as secondary package advisory source. Validate ecosystem/version range semantics before automated use.</td></tr><tr><td align="right">22</td><td><strong>European Union Vulnerability Database - EUVD</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://euvd.enisa.europa.eu/">EUVD portal</a>, <a href="https://www.enisa.europa.eu/">ENISA</a><br><br><strong><code>Access / Cost</code>:</strong> Free public portal; API/feed endpoint should be verified manually if used for ingestion.</td><td><strong><code>Relevance</code>:</strong> European vulnerability database &#x26; CVE/EUVD cross-reference context for EU vulnerability governance.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Add as manual-review lifecycle source until official API/feed endpoints are documented &#x26; tested.</td></tr><tr><td align="right">23</td><td><strong>Open Source Vulnerability Data - VulZoo dataset</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/NUS-Curiosity/VulZoo">VulZoo GitHub</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repository.</td><td><strong><code>Relevance</code>:</strong> Research dataset aggregating multiple vulnerability intelligence sources with scripts for synchronization, cleaning, relationship mining, &#x26; statistics.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Research/supporting dataset, not canonical operational feed. Useful for model development &#x26; source-coverage comparison.</td></tr><tr><td align="right">24</td><td><strong>CVEfixes vulnerability-fix dataset</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/secureIT-project/CVEfixes">CVEfixes GitHub</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repository.</td><td><strong><code>Relevance</code>:</strong> Dataset linking CVEs with vulnerable code, fixing commits, repositories, &#x26; software metrics.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for CVE lifecycle work around patch links, vulnerable-code evidence, &#x26; ML/research datasets.</td></tr></tbody></table>

## Discussion

This chapter section keeps the latest table structure, source titles, access/cost fields, relevance notes, & operational notes from the source inventory. Review the table entries as ingestion candidates, then validate source freshness, licensing, authentication requirements, & link-check behavior before production use.

***

#### [Back to Index](/vulnkeeper/index.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://breachtrace.gitbook.io/vulnkeeper/chapter-a/02-2-canonical-vulnerability-identifiers-cve-records-and-schemas.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.