Search results

CNA Rules: Clarify "identify" in 5.1

Status: Open.

#55 In CVEProject/cve-documents;

· zmanion opened on Jul 27, 2026

Rules Change Request: CNA container must independently satisfy required content, with no ADP backstop

4.3.0Candidates for 4.3.0.Candidates for 4.3.0.

Status: Open.

#54 In CVEProject/cve-documents;

· boblord opened on Jul 20, 2026

Rules Change Request: Mandatory assignment and disclosure for vulnerabilities affecting downstream operators, users, or customers

4.3.0Candidates for 4.3.0.Candidates for 4.3.0.

Status: Open.

#53 In CVEProject/cve-documents;

· boblord opened on Jul 20, 2026

Rules Change Request: Mandatory minimum good-faith safe harbor commitment in CNA disclosure policies

4.3.0Candidates for 4.3.0.Candidates for 4.3.0.

Status: Open.

#52 In CVEProject/cve-documents;

· boblord opened on Jul 20, 2026

Rules Change Request: Mandatory functioning vulnerability intake mechanism

Status: Open.

#51 In CVEProject/cve-documents;

· boblord opened on Jul 20, 2026

Rules Change Request: Prohibit CNA bypass of the CVE Record API and validation library

Status: Open.

#50 In CVEProject/cve-documents;

· boblord opened on Jul 20, 2026

Rules Change Request: Structured, machine-resolvable product and version identification

Status: Open.

#49 In CVEProject/cve-documents;

· boblord opened on Jul 20, 2026

Update 4.2.6 from SHOULD to MUST: "CNAs MUST assign different CVE IDs to separate Vulnerabilities"

Status: Open.

#47 In CVEProject/cve-documents;

· jayjacobs opened on Jul 12, 2026

Proposed revisions to CNA rules to clarify inclusion rules for AI vulns

4.3.0Candidates for 4.3.0.Candidates for 4.3.0.

Status: Open.

#46 In CVEProject/cve-documents;

· sromanoss opened on Jul 10, 2026

Public reference requirements should guarantee free community reuse, not just free access.

Status: Open.

#45 In CVEProject/cve-documents;

· jgamblin opened on Jul 7, 2026

"most freely available public reference" is not a defined term

Status: Open.

#44 In CVEProject/cve-documents;

· jgamblin opened on Jul 7, 2026

"Publicly Disclosing a CVE ID" is undefined and creates a weaker MUST for third-party disclosure

Status: Open.

#43 In CVEProject/cve-documents;

· jgamblin opened on Jul 7, 2026