[
{
"id": "pc_intro",
"title": "Introduction",
"questions": [
{
"id": "what_is_cve",
"text": "What is CVE",
"response": [
"The mission of the Common Vulnerabilities and Exposures (CVE™) Program is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. See the Overview page for additional information."
]
},
{
"id": "contact_cve",
"text": "How do I contact the CVE Program",
"response": [
"CVE Numbering Authorities (CNAs)/Roots",
"Contact methods for individual CNAs and Roots are provided on the List of Partners page.",
"CVE Program Secretariat",
"Use the CVE Program Web Forms for ALL inquiries to the CVE Program Secretariat.",
"Once submitted, requesters will receive a ticket number and see responses in the web form portal. An email message will also be sent when a response to the request is posted in the portal. Visit the web forms for additional information.",
"If encrypted communications are required, use the CVE Program Secretariat/MITRE CNA-LR PGP key:
Key ID: 488CE54A
Fingerprint: 5838 5FFE 7B29 42D2 0D6E 801E 8FFB E034 488C E54A
Key size: 4096
Public key: Click to download (TXT, 0.4MB)
Note: PGP key updated March 2026"
]
},
{
"id": "cve_license",
"text": "Does CVE have a license",
"response": [
"CVE is free for public use under the program’s terms of use."
]
},
{
"id": "what_is_vulnerability",
"text": "What is a “vulnerability”",
"response": [
"See Vulnerability on the Glossary page."
]
},
{
"id": "does_cve_contain_all_vulnerabilities",
"text": "Does the CVE List contain all vulnerabilities",
"response": [
"The intention of the CVE Program is to be comprehensive with respect to all publicly known vulnerabilities. While CVE prioritizes the assignment of CVE Records for the vendors, products, and product categories listed on the List of Partners page, a CVE ID may be requested for any vulnerability."
]
},
{
"id": "is_cve_another_vulnerability_database",
"text": "Is CVE just another vulnerability database",
"response": [
"No, CVE is not a vulnerability database. CVE enables the correlation of vulnerability data across tools, databases, and people. This enables two or more people or tools to refer to a vulnerability and know they are referring to the same issue."
]
},
{
"id": "hackers_break",
"text": "Can hackers use this to break into my network",
"response": [
"Any public discussion of vulnerability information may help a hacker. However, there are several reasons why the benefits of CVE outweigh its risks: ",
"- CVE is restricted to publicly known vulnerabilities.
- For a variety of reasons, sharing information is more difficult within the cybersecurity community than it is for hackers.
- It takes much more work for an organization to protect its networks and fix all possible holes than it takes for a hacker to find a single vulnerability, exploit it, and compromise the network.
- Community opinion supports sharing information, reflected in the CVE Numbering Authorities (CNAs), CVE Working Groups, and CVE Board, as each includes key professionals and organizations in cybersecurity.
"
]
},
{
"id": "public_use",
"text": "How can CVE help me",
"response": [
"CVE helps because it enables rapid data correlation regarding a vulnerability across multiple information sources that are compatible with CVE. For example, if you own a security tool whose reports contain references to CVE IDs, you may then access fix information in a separate database that is compatible with CVE. CVE also provides you with a baseline for evaluating the coverage of your tools. With CVE’s common identifiers, you’ll know exactly what each tool covers allowing you to determine which tools are most effective and appropriate for your organization’s needs.",
"In addition, if the security advisories your organization receives include CVEs, you can see if your vulnerability scanners check for this threat and then determine whether your intrusion detection system has the appropriate attack signatures to identify attempts to exploit particular vulnerabilities. If you build or maintain systems for customers, the inclusion of CVEs in advisories will help you to directly identify any fixes from the vendors of the commercial software products in those systems (if the vendor fix site is compatible with CVE)."
]
},
{
"id": "what_types_of_products_use_cve",
"text": "What types of products and services include CVE Records or reference CVE IDs",
"response": [
"CVE Records and CVE IDs are used in a variety of cybersecurity-related products and services including security advisories; vulnerability databases; vulnerability and security websites; vulnerability assessment, notification, and remediation; intrusion detection and management; intrusion monitoring and response; data/event correlation; firewalls; incident management; security information management; policy compliance; patch management; etc. "
]
},
{
"id": "who_owns_cve",
"text": "Who owns CVE",
"response": [
"Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). CISA funds the Homeland Security Systems Engineering and Development Institute (HSSEDI), a DHS Federally Funded Research and Development Center (FFRDC) operated by The MITRE Corporation, to operate the CVE Program in cooperation with industry, government, and academic stakeholders under a public/private partnership."
]
},
{
"id": "MITRE_role_in_cve",
"text": "What is MITRE’s role",
"response": [
"HSSEDI, a DHS FFRDC operated by The MITRE Corporation, executes the CVE Program Secretariat, MITRE Top-Level Root (TL-Root), and CNA of Last Resort (CNA-LR) functions within the MITRE TL-Root. The MITRE Corporation owns the CVE trademark and the registered CVE logo trademark to ensure the program remains free for public use."
]
},
{
"id": "cve_board",
"text": "What is the CVE Board",
"response": [
"Through open and collaborative discussions, the CVE Board ensures that the CVE Program meets the vulnerability identification needs of the global cybersecurity and technology community. Board members represent numerous cybersecurity-related organizations, including commercial security tool vendors, academia, research institutions, government departments and agencies, and other prominent security experts, as well as end-users of vulnerability information. All Board Meetings and Board Email Discussions are archived for the community."
]
},
{
"id": "working_groups",
"text": "What are the CVE Working Groups (WGs) and how can I participate",
"response": [
"CVE WGs actively focus on improving processes, workflows, and other aspects of the program as CVE continues to grow and expand. Current WGs focus on the following topics: Automation (AWG), Consumer (CWG), CNA Organization of Peers (COOP), CVE Artificial Intelligence (CVEAI), Outreach and Communications (OCWG), Quality (QWG), Researcher (RWG), Strategic Planning (SPWG), Tactical (TWG), and Vulnerability Conference and Events (VCEWG).",
"For additional information, see How to Join and Meeting Schedule on the Working Groups page."
]
},
{
"id": "cve_nvd_relationship",
"text": "What is the relationship between CVE and the NVD (U.S. National Vulnerability Database)",
"response": [
"CVE and NVD are two separate programs. The CVE List was launched by the MITRE Corporation as a community effort in 1999. The U.S. National Vulnerability Database (NVD) was launched by the National Institute of Standards and Technology (NIST) in 2005. The CVE List feeds NVD, which historically has built upon the information included in CVE Records to provide enhanced information for each record in its database. While separate, output from both programs is available to the public and free to use."
]
}
]
},
{
"id": "pc_cve_id_requests",
"title": "CVE ID Requests",
"questions": [
{
"id": "what_is_cve_id",
"text": "What is a CVE ID",
"response": [
"A CVE ID is the number portion of a CVE Record (CVE-YYYY-NNNN)."
]
},
{
"id": "request_id",
"text": "How do I request a CVE ID",
"response": [
"CNAs should follow the instructions here.",
"Other contributors (not a CNA), please visit Request a CVE ID and follow the steps provided."
]
},
{
"id": "wait_for_follow_up",
"text": "How long should I wait to follow up on my CVE ID request",
"response": [
"Each CNA or CNA-LR has different submission processing procedures and response times. In general, CVE ID processing times may be affected by a variety of factors including incomplete or incorrect submissions, the ability to verify the provided references, volume of submissions, and other factors. CNA-LRs may also need to coordinate with another CNA if the request is an appeal, or to ensure that the request is within the CNA-LR’s scope. If a response time is not stated in the particular CNA’s or CNA-LR’s disclosure policy, wait at least several working days before following up on your request. Contact the CNA using its stated contact method."
]
},
{
"id": "cve_id_appeal",
"text": "How do I appeal a CVE ID request rejection",
"response": [
"Each CNA has a Root or Top-Level Root (TL-Root) indicated on the List of Partners page, and each TL-Root has designated a CNA of Last Resort (CNA-LR) to address appeals. Contact the CNA-LR using its stated contact method."
]
},
{
"id": "when_contact_cna_lr",
"text": "When should I contact a CNA of Last Resort (CNA-LR) to request a CVE ID",
"response": [
"Contact a CNA-LR if (1) your request was rejected by a CNA, but you believe the reason for the rejection was not valid, or (2) there are no CNAs with a scope covering the vulnerability you wish to report. CNA-LRs are included on the List of Partners page and their scopes are the same as those for their Top-Level Root; contact the appropriate CNA-LR using its stated contact method."
]
}
]
},
{
"id": "pc_cve_records",
"title": "CVE Records",
"questions": [
{
"id": "what_is_cve_record",
"text": "What is a CVE Record",
"response": [
"A CVE Record is the descriptive data about a vulnerability associated with a CVE ID, provided by a CVE Numbering Authority (CNA). This data is provided in CVE JSON format.",
"See the Process page for additional information."
]
},
{
"id": "cve_list_vulnerability",
"text": "How does a vulnerability become a CVE Record",
"response": [
"See CVE Record Lifecycle."
]
},
{
"id": "cve_record_descriptions_created",
"text": "How are the CVE Record DESCRIPTIONS created or compiled",
"response": [
"The “Description” portion of CVE Records are typically written by CNAs, CNA-LRs, or individuals requesting a CVE ID.",
"As noted in Section 5.2 Description of the CNA Rules: “Through automation efforts such as the CVE Record Format and CVE Services, the content of the prose description in a CVE Record is becoming less important. The prose description is still useful in providing sufficient information to uniquely identify the Vulnerability and distinguish it from similar Vulnerabilities.”",
"Refer to Section 5.2 Description in the CNA Rules for all requirements regarding the Description field of CVE Records."
]
},
{
"id": "cve_record_references",
"text": "Are there REFERENCES available for CVE Records",
"response": [
"See to Section 5.3 Public References in the CNA Rules for detailed information about references in CVE Records.",
"References are valid as of the date the CVE Record is published to the CVE List. Over time, if a Reference uniform resource locator (URL) stops working, the URL will be retained for historical purposes.",
"Important: The CNA that published the CVE Record must be contacted to request that an additional Reference be added to a CVE Record."
]
},
{
"id": "date_record_created_in_cve_record",
"text": "What does DATE RECORD CREATED signify in a CVE Record",
"response": [
"The “Date Record Created” date in a CVE Record indicates when the CVE ID was issued to a CVE Numbering Authority (CNA) or the CVE Record was published on the CVE List.",
"This date does not indicate when the vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. That information may or may not be included in the description or references of a CVE Record."
]
},
{
"id": "reserved_signify_in_cve_record",
"text": "What does it mean when a CVE Record is marked RESERVED",
"response": [
"A CVE Record is marked as “RESERVED” when it has been reserved for use by a CVE Numbering Authority (CNA) or security researcher, but the details of it are not yet published. “RESERVED” is the initial state for a CVE Record; when the associated CVE ID is Reserved by a CNA.",
"A CVE Record can change from the RESERVED state to being published at any time based on a number of factors both internal and external to the CVE List."
]
},
{
"id": "disputed_signify_in_cve_record",
"text": "What does it mean when a CVE Record is marked DISPUTED",
"response": [
"When one party disagrees with another party’s assertion that a particular issue is a vulnerability, a CVE Record assigned to that issue may be designated with a “DISPUTED” tag. In these cases, the CVE Program is making no determination as to which party is correct. Instead, by adding the DISPUTED tag the program allows the reader to be informed of a potential vulnerability and enables the reader, by allowing the record to remain published with the DISPUTED tag, to decide whether the disputed report represents a threat to their organization’s assets.",
"Note that there is no set timeframe for how long a CVE Record may have a DISPUTED tag. In some cases, the DISPUTED tag may remain in place indefinitely. See “A Clarification on CVE Records with a DISPUTED Tag” for more information.",
"When you see a CVE Record that is DISPUTED, the CVE Program encourages you to research the issue through the references or by contacting the affected vendor or developer for more information.",
"See Section 4.6 Dispute Resolution in the CNA Rules and the CVE Program Policy and Procedure for Disputing a CVE Record for detailed information."
]
},
{
"id": "reject_signify_in_cve_record",
"text": "What does it mean when a CVE Record is marked REJECTED",
"response": [
"A CVE Record listed as “REJECTED” is a CVE Record that is not accepted as a CVE Record. The reason a CVE Record is marked REJECTED will most often be stated in the description of the CVE Record. Possible examples include it being a duplicate CVE Record, it being withdrawn by the original requester, it being assigned incorrectly, or some other administrative reason.",
"As a rule, REJECTED CVE Records should be ignored and the CVE ID and the associated CVE Record should no longer be used. A REJECTED CVE Record remains on the CVE List so that users know that the CVE ID and CVE Record are invalid."
]
},
{
"id": "why_cve_record_marked_RESERVED_when_being_publicly_used",
"text": "Why is a CVE Record marked as RESERVED when a CVE ID is being publicly used",
"response": [
"A CVE ID in the “RESERVED” state that is referenced in one or more public resources, but for which the details have not be published in a CVE Record, is considered a “Reserved but Public (RBP)” CVE ID.",
"Often, an RBP CVE ID occurs because the original requester of the CVE ID assignment has not sent an update to the CVE List including the information needed to publish the CVE Record. Note that a CVE Record cannot be published with details until a public reference exists that describes the vulnerability in question.",
"If you are aware of a CVE ID that is being used publicly but is not yet included in the CVE List (i.e., CVE Record is still marked as RESERVED), or you have additional information for an already published CVE Record, you can request that the CVE Record be updated by contacting the CNA that assigned the CVE ID."
]
},
{
"id": "update_existing_information_in_cve_record",
"text": "How do I request updates to a CVE Record",
"response": [
"The CNA that published the CVE Record must be contacted to request an update. Refer to the List of Partners page for CNA contact information."
]
},
{
"id": "does_cve_record_credit_discoverer",
"text": "Do CVE Records cite the discoverers of the vulnerabilities",
"response": [
"Per Section 5.2.4 of the CNA Rules: “CNAs MAY credit or acknowledge people, organizations, or tools in their own Vulnerability advisories or other information about Vulnerabilities or using the optional “credits” or “source” elements of the CVE Record Format.” This information is viewable in the CVE JSON for the CVE Record. Please note that such credits are only allowed in these two stated fields and are not allowed in the Description field of a record, per Section 5.2.4."
]
}
]
},
{
"id": "pc_cve_list_basics",
"title": "Using the CVE List",
"questions": [
{
"id": "cve_list_data_feeds",
"text": "Are there CVE List data feeds",
"response": [
"Yes, both internal and external feeds of CVE List content are available.",
"CVE Program:",
"External:- CVE Change Logs free tool from CERIAS/Purdue University that provides daily and monthly changes to CVE Records.
"
]
},
{
"id": "download_cve_copy",
"text": "How do I download a copy of CVE",
"response": [
"See Downloads."
]
},
{
"id": "search_cve",
"text": "How do I search the CVE List",
"response": [
"You may search using:
- CVE ID
- Specific CVE ID (e.g., “CVE-2015-8405”)
- Note that this returns records where there is a match for the CVE ID anywhere in the CVE Record (e.g., “CVE-2015-8405” returns the CVE named, as well as any CVEs that have that CVE ID in other fields, such as in the description)
- Date and Date Range Search
- You can perform date searches on date fields, using the following formats
- YYYY-MM-DD (e.g., 2025-10-28)
- YYYY-MM-DDTHH:MM:SS (e.g., 2025-10-28T12:00:00-4:00 for noon on that date New York time)
- You can perform date range searches by separating a beginning date/time and the ending date/time with 2 periods
- YYYY-MM-DD..YYYY-MM-DD (e.g., 2025-10-27..2025-10-28 for the 48 hour period between those 2 dates)
- YYYY-MM-DDTHH:MM:SS..YYYY-MM-DDTHH:MM:SS (e.g., 2025-10-28T01:30:00..2025-10-28T01:45:00 for the 15 minute period between those 2 timestamps)
- If you do not specify a time zone, the \"Z\" time zone is assumed (i.e., Greenwich Mean Time)
- Date ranges are inclusive, meaning the search will include both the starting date and the ending date in the results
- Exact Phrase Search
- Surround the phrase in double quotes (e.g., \"access denied\")
- You can mix and match phrases and words (e.g., \"access denied\" vuln*)
- General
- Note that if you provide multiple CVE IDs, the search will only return results that contain ALL CVE IDs you specify in each record, which may not be what you expect
- Note that currently you cannot mix text search with date/range search, you can only search on one or the other
- Search terms are case-insensitive and may contain words of alphanumeric and Unicode characters
- The wildcard characters “*” and “?” are now supported, which allows searching for patterns instead of only exact matches. For example, searching for “vuln*” would return any CVE Records that contains the word “vulnerable” or “vulnerability”, as well as any other word that starts with “vuln”. The “?” is similar but matches only a single character, useful for finding slight variations in how a word is spelled. Including the “?” will match any letter, number, or symbol in the position in which it is placed. For example, searching for “reject??” would return any CVE Records that include “reject” followed by any other two characters (i.e., letters, numbers, or symbols) such as “rejected”, “rejector”, “reject61”, etc.
- Supported search scenarios include:
- Wildcards (e.g., “vuln*”, “reject??”)
- Hyphenated words (e.g., “man-in-the-middle”)
- Exact version strings (e.g., “6.17.4”)
- Exact IPv4 strings (e.g., “127.0.0.1”)
- Date (e.g., YYYY-MM-DD [e.g., 2025-11-12] or YYYY-MM-DDTHH:MM:SS [e.g., 2025-11-28T12:00:00-4:00])
- Date range (e.g., YYYY-MM-DD..YYYY [e.g., 2025-11-12..2025-11-28] or YYYY-MM-DDTHH:MM:SS..YYYY-MM-DDTHH:MM:SS [e.g., 2025-10-28T01:30:00..2025-10-28T01:45:00])
- Exact phrase (e.g., “access denied”)
- Exact filenames (e.g., “main.cpp”)
- URLs (e.g., “http://www.ibm.com/support/docview.wss?uid”)
- Symbols currently not supported are:\u00a0\u00a0\u00a0() {} [] ' ` <> | ; ! ~ ^ + %
"
]
},
{
"id": "search_cve_and",
"text": "In the search box on CVE.ORG, what CVE Record fields are searched",
"response": [
"For text searches, all CVE Record fields are searched when using the search box on CVE.ORG. However, if the search comprises more than one keyword, all keywords must be present in a given field for the record to be returned.",
"For date and date range searches, only standard CVE date fields defined in the schema (e.g., date updated) are searched."
]
},
{
"id": "cve_list_serverity_ratings",
"text": "Does the CVE List include severity ratings (i.e., CVSS scores) for CVE Records",
"response": [
"The CVE Record Format enables CNAs to include CVSS or other severity rating scores in their CVE Records when publishing them to the CVE List."
]
},
{
"id": "cve_list_cve_include_fix_information",
"text": "Does CVE include fix information, impact, classification, or other important technical details",
"response": [
"The CVE Record Format specifies all required and optional data that is, or may be, included in CVE Records. Examples of these optional data fields include CWE information, severity scores, credit for researchers, additional languages, affected product lists, additional references, ability for community contributions, etc. Fix and other technical information for CVE Records can often be found in numerous vulnerability websites, databases, and security tool databases."
]
},
{
"id": "cve_list_use_taxonomy",
"text": "Does CVE use a taxonomy",
"response": [
"No. Developing a universally applicable taxonomy for vulnerabilities is an ongoing area of research. One goal of CVE is to capture community agreement. The enumeration and categorization of vulnerabilities are different (albeit related) efforts. The effort of building and populating the CVE List may facilitate further advances in the study of vulnerability taxonomies."
]
},
{
"id": "cve_list_retire_term_cve_candidates",
"text": "Why did CVE retire the term CVE “candidates”",
"response": [
"When the CVE effort first began in 1999 and vulnerabilities were discovered and published less frequently than they are today, CVEs were issued "candidate" or "entry" status, where candidate status indicated that the identifier was under review for inclusion on the CVE List and entry status indicated that the identifier has been formally accepted to the list. CVEs with candidate status used the CAN-prefix (e.g., "CAN-1999-0067"), while CVEs with entry status used the CVE-prefix (e.g., "CVE-1999-0067"). This meant that the individual identifier numbers themselves would need to be changed once a candidate had been updated to entry status, placing a significant burden on the numerous vendors and organizations around the world that would in turn need to update their tools and processes to accommodate the replacement identifier numbers. This became especially burdensome as the volume of vulnerabilities being discovered and added to the CVE List increased each year (CVE Records are now added to the CVE website on a daily basis). Therefore, at the request of the community, as of 2005 all CVE Records now use the CVE-prefix and are immediately usable by the community. While references and other supporting information may be updated over time, the CVE ID itself does not change once it has been assigned to an issue."
]
},
{
"id": "include_cve_ids",
"text": "Can I include CVE IDs in my product/database/security advisory/etc.",
"response": [
"Yes, CVE is free for public use. You may search or download the CVE List, copy it, redistribute it, reference it, and analyze it, provided you do not modify CVE itself. You may also link to specific CVE Record pages from your website, product, publication, or other capability. See the Terms of Use."
]
}
]
},
{
"id": "pc_cna",
"title": "CVE Numbering Authorities (CNAs)",
"questions": [
{
"id": "what_is_cna",
"text": "What is a CNA",
"response": [
"CNAs are vendor, researcher, open source, CERT, hosted service, bug bounty provider, and consortium organizations authorized by the CVE Program to assign CVE IDs to vulnerabilities and publish CVE Records within their own specific scopes of coverage.",
"CNAs join the program from a variety of business sectors; there are minimal requirements, and there is no monetary fee or contract to sign.",
"See List of Partners for current participants and the CNAs page in the Program Organization section for information about the different types of CNAs and their roles and responsibilities."
]
},
{
"id": "cost_to_become_cna",
"text": "How much does it cost to become a CNA",
"response": [
"There is no monetary fee. CNAs volunteer their own time for their own benefit. There is also no contract to sign.",
"Visit the Partners page for a list of benefits and to partner with the CVE Program as a CNA."
]
},
{
"id": "cna_requirements",
"text": "What are the requirements to become a CNA",
"response": [
"There are only three basic requirements: (1) have a public vulnerability disclosure policy, (2) have a public source for new vulnerability disclosures, (3) agree to the CVE Terms of Use."
]
},
{
"id": "how_to_be_involved",
"text": "How can my organization become a CNA",
"response": [
"See How to Become a Partner."
]
},
{
"id": "cna_resources",
"text": "What resources are available for CNAs",
"response": [
"See CNA Resources for a complete list of documents and videos for CNAs.",
"CNAs may also contact their Root for assistance."
]
},
{
"id": "reserve_cve_id_publish_cve_record",
"text": "How can my organization reserve CVE IDs and publish CVE Records",
"response": [
"CNAs use automated services to reserve CVE IDs and publish CVE Records. See Reserve IDs & Publish Records for CNAs for additional information."
]
},
{
"id": "retrieve_reserve_cve_ids_list",
"text": "How can my organization retrieve a list of our RESERVED CVE IDs",
"response": [
"“Reserved” CVE ID information is available via CVE Services. The CVE Services client applications are helpful for viewing your organization’s Reserved CVE IDs.",
"See these videos for additional information:",
"",
"To use the CVE Services API to view your Reserved CVE IDs, see the documentation here and use the first API call “/cve-id” with query parameters. Below is an example using Curl*:",
"curl --location --request GET 'https://cveawg.mitre.org/api/cve-id?state=RESERVED&cve_id_year=2023' --header 'CVE-API-USER: ' --header 'CVE-API-ORG: ' --header 'CVE-API-KEY: '"
]
}
]
}
]