Issues

• Rules Change Request: 4.2.18 should key on the purpose of the artifact, not the provenance of the vulnerability

  CVEProject/cve-documents#63 · Filter by author xfscott opened on Sep 7, 2026

• Bug: The (a) canonical rules changelog is numbered backwards

  bug
  CVEProject/cve-documents#61 · Filter by author todb opened on Aug 27, 2026
  5

  

• Proposal: Add Explicit Markdown Support for CVE Record Descriptions

  CVEProject/cve-documents#56 · Filter by author adulau opened on Aug 5, 2026

• CNA Rules: Clarify "identify" in 5.1

  CVEProject/cve-documents#55 · Filter by author zmanion opened on Jul 27, 2026
  1

• Rules Change Request: CNA container must independently satisfy required content, with no ADP backstop

  4.4.0
  CVEProject/cve-documents#54 · Filter by author boblord opened on Jul 20, 2026
  4

• Rules Change Request: Mandatory assignment and disclosure for vulnerabilities affecting downstream operators, users, or customers

  4.4.0
  CVEProject/cve-documents#53 · Filter by author boblord opened on Jul 20, 2026
  1

• Rules Change Request: Mandatory minimum good-faith safe harbor commitment in CNA disclosure policies

  4.4.0
  CVEProject/cve-documents#52 · Filter by author boblord opened on Jul 20, 2026
  2

• Rules Change Request: Mandatory functioning vulnerability intake mechanism

  CVEProject/cve-documents#51 · Filter by author boblord opened on Jul 20, 2026
  1

• Rules Change Request: Prohibit CNA bypass of the CVE Record API and validation library

  CVEProject/cve-documents#50 · Filter by author boblord opened on Jul 20, 2026

• Rules Change Request: Structured, machine-resolvable product and version identification

  CVEProject/cve-documents#49 · Filter by author boblord opened on Jul 20, 2026

• Update 4.2.6 from SHOULD to MUST: "CNAs MUST assign different CVE IDs to separate Vulnerabilities"

  4.3.0
  CVEProject/cve-documents#47 · Filter by author jayjacobs opened on Jul 12, 2026
  13

• Proposed revisions to CNA rules to clarify inclusion rules for AI vulns

  4.4.0
  CVEProject/cve-documents#46 · Filter by author sromanoss opened on Jul 10, 2026
  5

• Public reference requirements should guarantee free community reuse, not just free access.

  CVEProject/cve-documents#45 · Filter by author jgamblin opened on Jul 7, 2026
  3

• "most freely available public reference" is not a defined term

  CVEProject/cve-documents#44 · Filter by author jgamblin opened on Jul 7, 2026
  1

• "Publicly Disclosing a CVE ID" is undefined and creates a weaker MUST for third-party disclosure

  CVEProject/cve-documents#43 · Filter by author jgamblin opened on Jul 7, 2026

• MITRE's own CNA-LR records routinely fail to meet 5.1.3 and 5.1.7 (product and vulnerability type identification)

  CVEProject/cve-documents#42 · Filter by author jgamblin opened on Jul 7, 2026
  3

• Require CNA publication via CVE Services API, with accurate timestamps

  CVEProject/cve-documents#41 · Filter by author jgamblin opened on Jul 7, 2026
  1

• Proposal: Define CVE assignment SLAs for publicly disclosed and actively exploited vulnerabilities

  4.4.0
  CVEProject/cve-documents#39 · Filter by author yogeshnmittal opened on Jun 3, 2026
  8

• Distinguish physical access from software/firmware weaknesses that are discovered by opening the physical enclosure

  4.4.0
  CVEProject/cve-documents#38 · Filter by author GeorgesBolssens-Toreon opened on Apr 24, 2026
  2

• Companion document with examples, possibly additional guidance

  4.4.0
  CVEProject/cve-documents#34 · Filter by author zmanion opened on Feb 4, 2026
  4

• Kernel Pointer Leak impacting KASLR

  4.2.0ready
  CVEProject/cve-documents#31 · Filter by author brmonroe opened on Jan 20, 2026
  7

• Vulnerability determination for insecure default configurations

  4.2.0ready
  CVEProject/cve-documents#29 · Filter by author zmanion opened on Jan 8, 2026 · 2026-Q1
  26

  

• Separating vulnerability determination from first refusal

  4.2.0ready
  CVEProject/cve-documents#28 · Filter by author zmanion opened on Jan 7, 2026 · 2026-Q1
  2

  

• Better defining "most appropriate scope" and "appropriate scope"

  4.4.0needswork
  CVEProject/cve-documents#27 · Filter by author zmanion opened on Jan 7, 2026 · 2026-Q1
  12

  

• Exception to problem type requirement

  4.2.0ready
  CVEProject/cve-documents#26 · Filter by author zmanion opened on Jan 7, 2026 · 2026-Q1
  9