Repository navigation
Support CVE JSON 5.0 and Import https://github.com/CVEProject/cvelistV5 data #1015
Description
Currently VulnerableCode only supports CVE JSON 4.0 but soonish reports will be coming in CVE JSON 5.0 format, which will be a richer format with (possibly) more data:
https://www.cve.org/Media/News/item/news/2022/01/11/Changes-Coming-to-CVE-Record
https://www.cve.org/Media/News/item/blog/2022/01/18/CVE-List-Download-Formats-Are
I don't know when NVD starts publishing feeds in CVE JSON 5.0 format, but it might be good to be prepared.
Activity
pombredanne commentedon Nov 24, 2022
@armijnhemel Thanks... this is timely as we are working on migrating the Apache httpd advisories to the new internal framework and they are using the NVD v4
We need to add v5 indeed.
TG1999 commentedon Feb 6, 2024
https://github.com/CVEProject/cvelistV5/blob/main/cves/2023/1xxx/CVE-2023-1002.json it's an example of the format
TG1999 commentedon Feb 6, 2024
Check the GH repo and API data is similar or not
TG1999 commentedon Nov 26, 2024
@pombredanne please tell us the priority for this ticket.
pombredanne commentedon Aug 19, 2025
FYI we have support for this CVE schema in:
vulnerablecode/vulnerabilities/importers/vulnrichment.py
Line 54 in dcb0511
pombredanne commentedon Aug 19, 2025
Also CVE is working to adopt PURL:
pombredanne commentedon Aug 19, 2025
We should import https://github.com/CVEProject/cvelistV5/ directly and make this the true, correct data source for the CVEs. NVD should be demoted to something entirely secondary.
Also there are data we get that are always keyed by CVE: KEV, EPSS, some CVSS and a few more.
We need a design to flow down these values to an advisory from a CVE record.
Two possible designs come to mind:
[-]Support CVE JSON 5.0[/-][+]Support CVE JSON 5.0 and Import https://github.com/CVEProject/cvelistV5 data[/+]