Vulnerability Management Resources

The following are freely available vulnerability management resources. This list is non-exhaustive.

General

Common Vulnerabilities and Exposures: The Common Vulnerabilities and Exposures (CVE) Program provides a globally recognized, standardized set of identifiers and descriptions for publicly disclosed cybersecurity vulnerabilities, enabling users to uniquely refer to specific issues across different tools and platforms. By serving as a uniform "dictionary" rather than a deeply technical database, CVE ensures interoperability—security products, advisories, and databases can “speak” the same language—allowing organizations to reliably assess which vulnerabilities affect them and how well their tools cover those risks.

CISA Known Exploited Vulnerabilities Catalog (KEV): The KEV catalog provides a curated, authoritative list of CVEs that are currently being exploited in the wild. Unlike the broader CVE list, KEV prioritizes only those vulnerabilities with reliable evidence of real-world malicious activity, paired with available fixes or mitigations. This allows organizations to focus their vulnerability management efforts where they matter most—ensuring the most dangerous, actively exploited weaknesses are patched quickly.

Forum of Incident Response and Security Teams (FIRST): By providing interoperable scoring standards and service guidelines, FIRST empowers security professionals, vendor teams, and response organizations to communicate clearly, assess risk consistently, and act swiftly based on CVE data—turning a simple vulnerability identifier into a structured, actionable foundation for global cybersecurity collaboration.

Vulnerability Databases

European Union Vulnerability Database (EUVD): The EUVD, maintained by ENISA under the NIS2 Directive, extends and complements the global CVE ecosystem with regionally relevant, coordinated, and enriched vulnerability intelligence. Operating as a CVE Numbering Authority since January 2024, ENISA issues both EU-specific IDs and CVE IDs.

United States National Vulnerability Database: The NVD, managed by NIST, plays a pivotal role for CVE users by enriching CVE records. Each new CVE is ingested and enhanced with standardized metadata—severity scores (CVSS 3.1/4.0), weakness taxonomy (CWE), and explicit product coverage (CPE)—facilitating automated identification, prioritization, and remediation of vulnerabilities.

Japan Vulnerability Notes (JVN): The JVN, maintained jointly by the JPCERT Coordination Center (JPCERT/CC) and Information-technology Promotion Agency (IPA), acts as Japan’s national vulnerability database that both ingests and enriches CVE entries with detailed local context while also assigning its own JVN‑specific IDs. By participating as a CVE data source since 2008, JVN ensures that vulnerabilities affecting Japanese products or environments are quickly mapped to global CVEs and enhanced with precise remediation steps and translations.

Identification, Data, and Scoring Formats

Maintainer	Format	Summary
	Common Platform Enumeration (CPE)	Provides a standardized method to identify and describe software, hardware, and operating systems, enabling precise matching of vulnerabilities to affected products.
	Common Security Advisory Framework (CSAF)	Defines a machine-readable format for publishing and exchanging security advisories to improve automation and consistency in vulnerability communication.
	Common Vulnerability Scoring System (CVSS)	Supplies a standardized way to assess and communicate the severity of vulnerabilities based on their characteristics and potential impact.
	Common Weakness Enumeration (CWE)	Offers a structured catalog of common software and hardware weakness types to support analysis, training, and prevention of vulnerabilities.
	CVE Record Format	Establishes a standardized structure for CVE records, ensuring consistent, clear, and interoperable documentation of vulnerability identifiers and key metadata.
	Exploit Prediction Scoring System (EPSS)	Provides probabilistic scores estimating the likelihood that a given vulnerability will be exploited in the wild, helping prioritize remediation efforts.
PURL	Package URL	Defines a simple and consistent way to identify and locate software packages across different ecosystems, supporting precise tracking of vulnerable components.