CVE Record Format

The CVE Record Format is the JSON schema defining the structure of CVE records. It was previously called the "CVE Schema." This repository is maintained by the CVE Quality Working Group (QWG) under the QWG Charter.

This repository is part of the CVE Project and is governed by CVE's Professional Code of Conduct.

---

Read the Record Format

The version of the schema found on the main branch of this repository is the current production version used by CVE Services. The development version, which reflects work-in-progress changes planned for future production versions, is found on the develop branch.

Production Version

The current production version of the CVE Record Format is available in several forms:

• Separate files
• Single file
• Interactive
• Mindmap

Additionally, the CVE Record Format incorporates mechanisms for encoding product identity and version information, which are documented in greater detail.

Development Version

The development version of the CVE Record Format can be found in the develop branch:

• Separate files

Examples

• Example with minimum required fields
• More complete example
• A basic example of a cnaContainer, to be used with CVE Services
• An advanced example of a cnaContainer, to be used with CVE Services

Known Issues

The CVE Services page on the CVE site tracks known issues with the CVE Record Format.

Contributing

Work in this repository is managed by the CVE Quality Working Group. QWG meetings are open to CVE authorized program members, including:

• Members of the CVE Board
• Representatives of CVE Numbering Authorities (CNAs)
• Representatives of Authorized Data Publishers (ADPs)
• Participants from the CVE Secretariat (currently The MITRE Corporation)

On a case-by-case basis, the QWG can invite to participate, through consensus, individuals who are not CVE program members. To request admission to the QWG, please contact one of the QWG Co-Chairs, currently Chris Coffin (MITRE), MegaZone (F5), or David Waltermire (GSA FedRAMP).

Any individual is welcome to participate via Issues, Discussions, and Pull Requests, including opening issues, creating proposals, commenting on existing proposals in Pull Requests, and asking questions about the Record Format. Decisions on how to proceed with any proposal are made by the Quality Working Group via consensus. Final authority for approving or rejecting changes to the CVE Record Format lies with the CVE Board.

All participation in this project is subject to the rules and procedures of the CVE Professional Code of Conduct.