News & Events

Please use our LinkedIn page to comment on the articles below, or use our CVE Request Web Form by selecting “Other” from the dropdown.
Right-click and copy a URL to share an article.

LG Electronics Added as CVE Numbering Authority (CNA)
September 14, 2021 | Share this article

LG Electronics is now a CVE Numbering Authority (CNA) for LG Electronics products only. In addition, LG Electronics’ Root is the MITRE Top-Level Root.

To date, 184 organizations from 31 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Snow Software Added as CVE Numbering Authority (CNA)
September 14, 2021 | Share this article

Snow Software is now a CVE Numbering Authority (CNA) for all Snow Software products. In addition, Snow Software’s Root is the MITRE Top-Level Root.

To date, 183 organizations from 31 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Minutes from CVE Board Teleconference Meeting on September 1 Now Available
September 8, 2021 | Share this article

The CVE Board held a teleconference meeting on September 1, 2021. Read the meeting minutes.

Censys Added as CVE Numbering Authority (CNA)
September 7, 2021 | Share this article

Censys is now a CVE Numbering Authority (CNA) for all Censys products, and vulnerabilities discovered by Censys that are not in another CNA’s scope. In addition, Censys’s Root is the MITRE Top-Level Root.

To date, 182 organizations from 31 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

CVE Website Transitioning to New Web Address – “CVE.ORG”
September 2, 2021 | Share this article

As part of the CVE Program’s effort to improve the information and services the program provides, the CVE website is transitioning to a new web address: CVE.ORG. The phased quarterly transition process will begin no earlier than late September and will last for one year. During the transition, the new CVE.ORG website will operate concurrently with the CVE.MITRE.ORG website and new releases of the new website will occur at least every quarter. Upon completion of the phased transition, the CVE.MITRE.ORG website will be archived and retired at some point.

The new CVE.ORG website will host a new and modern version of the CVE.MITRE.ORG website. More information about the new website, and how the new and old websites will work together during the transition, will be available soon.

Please contact us with any comments or concerns.

TR-CERT Added as CVE Numbering Authority (CNA)
August 31, 2021 | Share this article

Computer Emergency Response Team of the Republic of Turkey (TR-CERT) is now a CVE Numbering Authority (CNA) for vulnerability assignment related to its vulnerability coordination role. In addition, TR-CERT’s Root is the MITRE Top-Level Root.

To date, 182 organizations from 31 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Minutes from CVE Board Teleconference Meeting on August 18 Now Available
August 24, 2021 | Share this article

The CVE Board held a teleconference meeting on August 18, 2021. Read the meeting minutes.

CVE Blog Publishes Article by CVE Community Member Rob Cowsley
August 17, 2021 | Share this article

In his article on the CVE Blog, CVE community member Rob Cowsley of Gallagher discusses how and why his organization partnered with the CVE Program as a CVE Numbering Authority (CNA) in “Our CVE Story: Leading the Way for Vulnerability Disclosures in Physical Security Systems.”

Minutes from CVE Board Teleconference Meeting on August 4 Now Available
August 17, 2021 | Share this article

The CVE Board held a teleconference meeting on August 4, 2021. Read the meeting minutes.

Minutes from CVE Board Teleconference Meeting on July 21 Now Available
August 17, 2021 | Share this article

The CVE Board held a teleconference meeting on July 21, 2021. Read the meeting minutes.

NetMotion Added as CVE Numbering Authority (CNA)
August 10, 2021 | Share this article

NetMotion Software is now a CVE Numbering Authority (CNA) for NetMotion issues only. In addition, NetMotion’s Root is the MITRE Top-Level Root.

To date, 181 organizations from 31 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

FPT Software Added as CVE Numbering Authority (CNA)
August 10, 2021 | Share this article

FPT Software Co., Ltd. is now a CVE Numbering Authority (CNA) for all products and services developed and operated by FPT Software, as well as vulnerabilities in third-party software discovered by FPT Software. In addition, FPT Software’s Root is the MITRE Top-Level Root.

To date, 180 organizations from 31 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Devolutions Added as CVE Numbering Authority (CNA)
July 20, 2021 | Share this article

Devolutions Inc. is now a CVE Numbering Authority (CNA) for Remote Desktop Manager and Devolutions Server products. In addition, Devolutions’ Root is the MITRE Top-Level Root.

To date, 179 organizations from 30 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Minutes from CVE Board Teleconference Meeting on July 7 Now Available
July 14, 2021 | Share this article

The CVE Board held a teleconference meeting on July 7, 2021. Read the meeting minutes.

Israel National Cyber Directorate Added as CVE Numbering Authority (CNA)
July 8, 2021 | Share this article

Israel National Cyber Directorate (INCD) is now a CVE Numbering Authority (CNA) for vulnerability assignment related to its vulnerability coordination role. In addition, INCD’s Root is the MITRE Top-Level Root. Read INCD’s news release.

To date, 178 organizations from 30 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

CVE Blog Publishes Article by CVE Community Member Tomo Ito
July 7, 2021 | Share this article

In his article on the CVE Blog, CVE community member Tomo Ito of JPCERT/CC, a member of two CVE Working Groups (CNACWG and OCWG), discusses how his organization became the CVE Program’s first-ever Root more than 10 years ago in “Our CVE Story: JPCERT/CC.”

Minutes from CVE Board Teleconference Meeting on June 23 Now Available
July 2, 2021 | Share this article

The CVE Board held a teleconference meeting on June 23, 2021. Read the meeting minutes.

ESET Added as CVE Numbering Authority (CNA)
June 23, 2021 | Share this article

ESET, spol. s r.o. is now a CVE Numbering Authority (CNA) for all ESET products only and vulnerabilities discovered by ESET that are not covered by another CNA’s scope. In addition, ESET’s Root is the MITRE Top-Level Root.

To date, 177 organizations from 30 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Hitachi ABB Power Grids Added as CVE Numbering Authority (CNA)
June 23, 2021 | Share this article

Hitachi ABB Power Grids is now a CVE Numbering Authority (CNA) for Hitachi ABB Power Grids products. In addition, Hitachi ABB Power Grids’ Root is the CISA ICS Top-Level Root.

To date, 176 organizations from 29 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

SolarWinds Added as CVE Numbering Authority (CNA)
June 17, 2021 | Share this article

SolarWinds is now a CVE Numbering Authority (CNA) for Solarwinds products only. In addition, SolarWinds’ Root is the MITRE Top-Level Root.

To date, 175 organizations from 29 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Fidelis Cybersecurity, Inc. Added as CVE Numbering Authority (CNA)
June 17, 2021 | Share this article

Fidelis Cybersecurity, Inc. is now a CVE Numbering Authority (CNA) for Fidelis issues only. In addition, Fidelis’ Root is the MITRE Top-Level Root.

To date, 174 organizations from 29 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

INCIBE Added as Root for Spain Organizations
June 17, 2021 | Share this article

Spanish National Cybersecurity Institute, S.A. (INCIBE) is now a Root for Spain organizations. Read INCIBE’s news release.

A “Root” is an organization authorized within the CVE Program that is responsible, within a specific scope, for the recruitment, training, and governance of one or more entities that are a CVE Numbering Authority (CNA), CNA of Last Resort (CNA-LR), or another Root. CNAs are organizations responsible for the regular assignment of CVE IDs to vulnerabilities, and for creating and publishing information about the vulnerability in the associated CVE Record. Each CNA has a specific scope of responsibility for vulnerability identification and publishing. CNA-LRs or organizations authorized within the CVE Program to assign CVE IDs and to create and publish CVE Records for vulnerabilities not covered by the scope of another CNA.

Read the CVE Program news release or see our “CVE Program Expands Partnership with Spanish National Cybersecurity Institute (INCIBE)” blog post for additional information.

To date, 173 organizations from 29 countries participate in the CVE Program as CNAs, and of these 2 are Top-Level Roots and 2 are Roots. To request a CVE ID number from a CNA, visit Request a CVE ID.

Minutes from CVE Board Teleconference Meeting on June 9 Now Available
June 17, 2021 | Share this article

The CVE Board held a teleconference meeting on June 9, 2021. Read the meeting minutes.

Patchstack Added as CVE Numbering Authority (CNA)
June 16, 2021 | Share this article

Patchstack is now a CVE Numbering Authority (CNA) for vulnerabilities in third-party PHP products discovered by Patchstack and Patchstack Red Team. In addition, Patchstack’s Root is the MITRE Top-Level Root.

To date, 173 organizations from 29 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Toshiba Added as CVE Numbering Authority (CNA)
June 16, 2021 | Share this article

Toshiba Corporation is now a CVE Numbering Authority (CNA) for vulnerabilities related to products and services of Toshiba Corporation. In addition, Toshiba’s Root is the JPCERT/CC Root. Read the Toshiba news release.

To date, 172 organizations from 28 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

CVE Services v1.1.1 Deployed for CVE Numbering Authorities (CNAs)
June 16, 2021 | Share this article

The goal of the CVE Services is to simplify and automate the reservation of CVE IDs and the submission and uploading of CVE Records to the CVE List for CNAs.

Released June 15-16, 2021, CVE Services v1.1.1 updates include implementing new initial User Registry functions/endpoints for CNAs for improved management of their CVE Services users and accounts. In addition, cvelib, a library and a command line interface for the CVE Services API that is free to use by all CNAs, was developed and released by Martin Prpic of Red Hat.

CVE Services v1.1.1 is a minor release and is backwards compatible with CVE Services v1.0.1, which was deployed for CNAs in December 2020.

Zyxel Corporation Added as CVE Numbering Authority (CNA)
June 14, 2021 | Share this article

Zyxel Corporation is now a CVE Numbering Authority (CNA) for Zyxel products issues only. In addition, Zyxel’s Root is the MITRE Top-Level Root.

To date, 171 organizations from 28 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Wordfence Added as CVE Numbering Authority (CNA)
June 10, 2021 | Share this article

Wordfence is now a CVE Numbering Authority (CNA) for WordPress Plugins, Themes, and Core Vulnerabilities discovered by, or reported to, the Wordfence/Defiant team. In addition, Wordfence’s Root is the MITRE Top-Level Root.

To date, 170 organizations from 28 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

CVE Blog Publishes Article by CVE Community Member Endika Gil-Uriarte
June 10, 2021 | Share this article

In his article on the CVE Blog, CVE community member and Endika Gil-Uriarte Chief Strategy Officer at Alias Robotics discusses how his organization partnered with the CVE Program as a CVE Numbering Authority (CNA) in “Our CVE Story: From Robot Security Research to Managing Robot Vulnerabilities.”

COMPLETED: CVE List Content Updates Unavailable from 6:00am on June 15 through 11:00pm on June 16 (EDT)
June 9, 2021 (Updated June 16, 2021) | Share this article

UPDATE: Infrastructure upgrades on the CVE website were completed, and normal operations resumed, on June 16, 2021 at 1:00 p.m. (EDT). We apologize for any inconvenience.

The CVE Program is upgrading the infrastructure used to add CVE List content to the CVE website. As a result, from 6:00 a.m. (EDT) on June 15, 2021 through 11:00 p.m. (EDT) on June 16, 2021 any data that is updated daily on a periodic basis (e.g., CVE List, @CVEnew tweets, download files) will not be updated. Normal operations are now scheduled to resume on June 16, 2021 at 11:00 p.m. (EDT).

Previously published CVE List content on the CVE website will remain accessible, as will all other website content, during the upgrades. In addition, submissions via the CVE Request Web Form and GitHub (CVE Numbering Authorities (CNAs)-only) may still be made during this time but will be processed once the upgrade is completed. We apologize for any inconvenience. Please contact us with any comments or concerns.

This announcement was also posted to Twitter and LinkedIn.

Becton, Dickinson and Company (BD) Added as CVE Numbering Authority (CNA)
June 2, 2021 | Share this article

Becton, Dickinson and Company (BD) is now a CVE Numbering Authority (CNA) for BD software-enabled medical devices only. In addition, BD’s Root is the CISA ICS Top-Level Root.

To date, 169 organizations from 28 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Fluid Attacks Added as CVE Numbering Authority (CNA)
June 1, 2021 | Share this article

Fluid Attacks is now a CVE Numbering Authority (CNA) for vulnerabilities in third-party software discovered by Fluid Attacks that are not in another CNA’s scope. In addition, Fluid Attack’s Root is the MITRE Top-Level Root.

To date, 168 organizations from 28 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Minutes from CVE Board Teleconference Meeting on May 26 Now Available
June 1, 2021 | Share this article

The CVE Board held a teleconference meeting on May 26, 2021. Read the meeting minutes.

CVE Board Statement on Distributed Weakness Filing Project Confusion
May 27, 2021 | Share this article

The CVE Board continues to encourage innovative approaches to improving the vulnerability management ecosystem, and encourages feedback specifically related to improving the CVE Program.

Subject to previous communications, the CVE Board is aware of existing and increasing confusion within the community regarding unauthorized entities assigning “CVE” identification (ID) numbers and publishing “CVE” records. To this end, the Distributed Weakness Filing (DWF) project, which is not an authorized CVE Numbering Authority (CNA) and is not following the established CVE Program rules, is infringing on the CVE namespace by issuing IDs using the CVE Program syntax in the CVE-2021-xxxxxxx (million) range.

These are not valid CVE IDs and records. They will not be included in the CVE List. The CVE Board wants to make this clear to community stakeholders to eliminate the confusion caused by the unauthorized use of the CVE namespace.

To obtain a valid CVE ID, please contact a legitimate CNA or contact the CVE Program Secretariat to become an authorized CNA. The list of CNAs is located at https://cve.mitre.org/cve/request_id.html#cna_participants.

- The CVE Board

New CVE Board Member from Palo Alto Networks
May 25, 2021 | Share this article

Chandan Nandakumaraiah of Palo Alto Networks has joined the CVE Board.

Read the full announcement and welcome message in the CVE Board email discussion list archive.

Minutes from CVE Board Teleconference Meeting on April 28 Now Available
May 10, 2021 | Share this article

The CVE Board held a teleconference meeting on April 28, 2021. Read the meeting minutes.

GS McNamara LLC Added as CVE Numbering Authority (CNA)
May 4, 2021 | Share this article

GS McNamara LLC is now a CVE Numbering Authority (CNA) for GS McNamara LLC products and services, including the Floodspark portfolio, and any vulnerabilities discovered in components or projects that we are researching or coordinating that are not in another CNA’s scope. In addition, GS McNamara LLC’s Root is the MITRE Top-Level Root.

To date, 167 organizations from 27 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

huntr.dev Added as CVE Numbering Authority (CNA)
April 30, 2021 | Share this article

huntr.dev is now a CVE Numbering Authority (CNA) for vulnerabilities in third-party code reported to huntr.dev. In addition, huntr.dev’s Root is the MITRE Top-Level Root.

To date, 166 organizations from 27 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Octopus Deploy Added as CVE Numbering Authority (CNA)
April 26, 2021 | Share this article

Octopus Deploy is now a CVE Numbering Authority (CNA) for all Octopus Deploy products, as well as Octopus Deploy maintained projects hosted on https://github.com/OctopusDeploy. Octopus’ Root is the MITRE Top-Level Root. Read the Octopus news release.

To date, 165 organizations from 27 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Zoom Added as CVE Numbering Authority (CNA)
April 23, 2021 | Share this article

Zoom Video Communications, Inc. is now a CVE Numbering Authority (CNA) for Zoom and Keybase issues only. Zoom’s Root is the MITRE Top-Level Root.

To date, 164 organizations from 27 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Minutes from CVE Board Teleconference Meeting on April 14 Now Available
April 20, 2021 | Share this article

The CVE Board held a teleconference meeting on April 14, 2021. Read the meeting minutes.

Vaadin Added as CVE Numbering Authority (CNA)
April 12, 2021 | Share this article

Vaadin Ltd. is now a CVE Numbering Authority (CNA) for all Vaadin products and supported open-source projects hosted at https://github.com/vaadin. Vaadin’s Root is the MITRE Top-Level Root. Read the Vaadin news release.

To date, 163 organizations from 27 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

CVE Blog Publishes Article by CVE Community Member Mark Cox
April 12, 2021 | Share this article

In his article on the CVE Blog, CVE Board Member Mark Cox of the Apache Software Foundation (ASF) discusses how ASF has partnered with the CVE Program as a CVE Numbering Authority (CNA) and its participation in the CVE Automation Working Group in “Our CVE Story: An Open-Source, Community-Based Example.”

Axis Added as CVE Numbering Authority (CNA)
April 8, 2021 | Share this article

Axis Communications AB is now a CVE Numbering Authority (CNA) for Axis products and solutions only. Axis’ Root is the MITRE Top-Level Root. Read the Axis news release.

To date, 162 organizations from 27 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Minutes from CVE Board Teleconference Meeting on March 31 Now Available
April 6, 2021 | Share this article

The CVE Board held a teleconference meeting on March 31, 2021. Read the meeting minutes.

Message to DWF from the CVE Board
April 2, 2021 | Share this article

Kurt Seifried and Josh Bressers,

The CVE Board encourages innovative approaches to improve cybersecurity. In this regard, we wish you the best of luck with respect to improving the vulnerability management ecosystem.

It has come to the CVE Board’s attention that DWF has recently begun attempting to issue CVE IDs via its GitHub community site. To the CVE Board’s knowledge, DWF has issued at least eight ID numbers that DWF purports to be “CVE” IDs. As you are aware, only CVE Numbering Authorities (CNAs) approved by the CVE Board are authorized to issue valid CVE IDs. DWF is not an approved CNA.

Attempts by non-CNAs to issue unauthorized “CVE” IDs is disruptive to the CVE numbering system no matter where these unapproved IDs fall in the numbering order, and this creates confusion in the CVE contributor and user communities. Issuing unauthorized “CVE” IDs undermines public trust in the entire CVE system. This erosion of trust degrades the CVE community’s ability to provide a free public resource to track vulnerabilities and reduce cybersecurity risk. Further, we consider issuing unauthorized “CVE” IDs to be unfair competition and a misappropriation of the trusted “CVE” brand that the CVE community has spent many years building. Finally, MITRE confirms it has not licensed DWF to use this mark, which is a registered trademark of the MITRE Corporation.

The CVE Board welcomes contributions from the cybersecurity community and encourages organizations to apply for CNA status. The CVE Board notes that DWF has not attempted to reapply for CNA status, and invites DWF do so. However, until DWF is an approved CNA, the CVE Board requests that DWF cease issuing “CVE” IDs and rename all current and future IDs that DWF issues.

Thank you for your prompt attention to this matter.

- The CVE Board

Synopsys Added as CVE Numbering Authority (CNA)
March 30, 2021 | Share this article

Synopsys is now a CVE Numbering Authority (CNA) for all Synopsys SIG products, as well as vulnerabilities in third-party software discovered by Synopsys SIG that are not in another CNA’s scope. Synopsys’ Root is the MITRE Top-Level Root.

To date, 161 organizations from 26 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

NEC Corporation Added as CVE Numbering Authority (CNA)
March 30, 2021 | Share this article

NEC Corporation is now a CVE Numbering Authority (CNA) for NEC issues only. NEC’s Root is the JPCERT/CC Root.

To date, 160 organizations from 26 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Minutes from CVE Board Teleconference Meeting on March 17 Now Available
March 23, 2021 | Share this article

The CVE Board held a teleconference meeting on March 17, 2021. Read the meeting minutes.

DeepSurface Security Added as CVE Numbering Authority (CNA)
March 22, 2021 | Share this article

DeepSurface Security, Inc. is now a CVE Numbering Authority (CNA) for all DeepSurface products, as well as vulnerabilities in third-party software discovered by DeepSurface that are not in another CNA’s scope. DeepSurface’s Root is the MITRE Top-Level Root.

To date, 159 organizations from 26 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Environmental Systems Research Institute Added as CVE Numbering Authority (CNA)
March 22, 2021 | Share this article

Environmental Systems Research Institute, Inc. (Esri) is now a CVE Numbering Authority (CNA) for all Esri products only. Esri’s Root is the MITRE Top-Level Root.

To date, 158 organizations from 26 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Xen Project Added as CVE Numbering Authority (CNA)
March 15, 2021 | Share this article

Xen Project is now a CVE Numbering Authority (CNA) for all sub-projects under Xen Project’s umbrella (see Xen Project Teams), except those sub-projects that have their own security response process; and the Xen components inside other projects, where Xen Project is the primary developer. Xen Project’s Root is the MITRE Top-Level Root.

To date, 158 organizations from 26 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

CVE Blog Publishes Article by CVE Community Member and Independent Vulnerability Researcher CNA Larry Cashdollar
March 15, 2021 | Share this article

In his article on the CVE Blog, CVE community member and independent vulnerability researcher CVE Numbering Authority (CNA) Larry Cashdollar discusses “My CVE Story: How I Became the CVE Program’s First Vulnerability Researcher CNA.”

Minutes from CVE Board Teleconference Meeting on March 3 Now Available
March 9, 2021 | Share this article

The CVE Board held a teleconference meeting on March 3, 2021. Read the meeting minutes.

Important Message About CVE ID Assignment
March 8, 2021 | Share this article

This is a reminder to the community that only CVE Numbering Authorities (CNAs) are authorized to assign CVE IDs.

CVE IDs obtained in some other way are not recognized by the CVE Program.

Arista Added as CVE Numbering Authority (CNA)
March 8, 2021 | Share this article

Arista Networks, Inc. is now a CVE Numbering Authority (CNA) for all Arista products only. Arista’s Root is the MITRE Top-Level Root.

To date, 157 organizations from 26 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Mautic Added as CVE Numbering Authority (CNA)
March 2, 2021 | Share this article

Mautic is now a CVE Numbering Authority (CNA) for Mautic core and officially supported plugins. Mautic’s Root is the MITRE Top-Level Root.

To date, 156 organizations from 26 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Simplinx Added as CVE Numbering Authority (CNA)
March 2, 2021 | Share this article

Simplinx Ltd. is now a CVE Numbering Authority (CNA) for Simplinx products only. Simplinx’s Root is the CISA ICS Top-Level Root.

To date, 155 organizations from 26 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Xylem Added as CVE Numbering Authority (CNA)
March 2, 2021 | Share this article

Xylem is now a CVE Numbering Authority (CNA) for Xylem products and technologies only. Xylem’s Root is the CISA ICS Top-Level Root.

To date, 154 organizations from 25 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Minutes from CVE Board Teleconference Meeting on February 17 Now Available
February 23, 2021 | Share this article

The CVE Board held a teleconference meeting on February 17, 2021. Read the meeting minutes.

Minutes from CVE Board Teleconference Meeting on February 3 Now Available
February 9, 2021 | Share this article

The CVE Board held a teleconference meeting on February 3, 2021. Read the meeting minutes.

Swift Project Added as CVE Numbering Authority (CNA)
February 4, 2021 | Share this article

Swift Project is now a CVE Numbering Authority (CNA) for the Swift Project only. Swift Project’s Root is the MITRE Top-Level Root.

To date, 153 organizations from 25 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

CVE Blog Publishes Article by CVE Community Member Jonn Perez of Trend Micro
February 1, 2021 | Share this article

In his article on the CVE Blog, CVE community member Jonn Perez of CVE Numbering Authority (CNA) Trend Micro discusses the benefits of leveraging the CVE Program in its vulnerability discovery and disclosure processes in “Our CVE Story: Learning to Embrace Recognition and Mitigations of Vulnerabilities as a Strength.”

New CVE Board Member from Pen Test Partners
January 20, 2021 | Share this article

Ken Munro of Pen Test Partners LLP has joined the CVE Board.

Read the full announcement and welcome message in the CVE Board email discussion list archive.

Minutes from CVE Board Teleconference Meeting on January 6 Now Available
January 15, 2021 | Share this article

The CVE Board held a teleconference meeting on January 6, 2021. Read the meeting minutes.

Sophos Added as CVE Numbering Authority (CNA)
January 13, 2021 | Share this article

Sophos Limited is now a CVE Numbering Authority (CNA) for Sophos issues only. Sophos’ Root is the MITRE Top-Level Root. Read the Sophos news release.

To date, 152 organizations from 25 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

WPScan Added as CVE Numbering Authority (CNA)
January 12, 2021 | Share this article

WPScan is now a CVE Numbering Authority (CNA) for WordPress core, plugins, and themes. WPScan’s Root is the MITRE Top-Level Root. Read the WPScan news release.

To date, 151 organizations from 25 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Samsung Mobile Added as CVE Numbering Authority (CNA)
January 11, 2021 | Share this article

Samsung Mobile is now a CVE Numbering Authority (CNA) for Samsung Mobile Galaxy products, personal computers, and related services only. Samsung Mobile’s Root is the MITRE Top-Level Root.

To date, 150 organizations from 25 countries participate in the CVE Program as CNAs. CNAs are organizations from around the world that are authorized to assign CVE Identifiers (CVE IDs) to vulnerabilities affecting products within their distinct, agreed-upon scope, for inclusion in first-time public announcements of new vulnerabilities.

To request a CVE ID number from a CNA, visit Request a CVE ID.

Page Last Updated or Reviewed: September 14, 2021