Skip to content

The CVE ecosystem: CNA, ADP, NVD and the CWE catalog

When CWE Explorer shows where a CVE–CWE link comes from, it uses labels such as apache (CNA), CISA-ADP, NVD and CWE catalog (observed example). Each label is a role in the vulnerability ecosystem. This page explains who plays each role, what each one contributes to a CVE, and how the pieces relate. Examples use the real records of Log4Shell (CVE-2021-44228) and Heartbleed (CVE-2014-0160).

For how the tool reads and merges this data, see How CWE Explorer links CVEs to CWEs.

At a glance

flowchart LR
    subgraph program["CVE Program · cve.org"]
        CNA["CNA<br/>e.g. Apache Software Foundation<br/>assigns the ID, writes the record"]
        subgraph record["CVE record (CVE List)"]
            CC["CNA container<br/>description, affected products,<br/>references, CWE?, severity?"]
            AC["ADP containers<br/>CISA-ADP: SSVC, KEV,<br/>missing CVSS / CWE<br/>CVE Program: references"]
        end
        ADP["ADPs<br/>e.g. CISA (Vulnrichment)<br/>add data, never edit the CNA's"]
        CNA --> CC
        ADP --> AC
    end
    subgraph nist["NIST"]
        NVD["NVD<br/>its own analysis:<br/>CVSS, CWE, CPE"]
    end
    CWE[("CWE catalog<br/>MITRE and community<br/>types of weakness")]
    record -- "every published record" --> NVD
    CWE -. "CWE IDs used to classify" .-> CC
    CWE -.-> AC
    CWE -.-> NVD
    CWE -- "cites some CVEs as<br/>observed examples" --> record
    record --> TOOL["cwex"]
    NVD --> TOOL
    CWE --> TOOL
Who does what. A CNA writes the CVE record and the ADPs add their own containers to it; the NVD analyzes every published record on its own; the CWE catalog provides the types of weakness that all of them use. cwex reads the record, the NVD and the catalog.
  • A CVE identifies one vulnerability in one product. A CWE names the type of mistake behind it.
  • The CVE record is a single document with several containers: one written by the CNA and one for each ADP that enriched it.
  • The NVD keeps its own copy of every record, with its own analysis added. That analysis lives in the NVD, not in the CVE record.
  • The CWE catalog is the shared dictionary of weakness types. It is also the only one of these sources that, by itself, cites CVEs for a CWE. The NVD can be searched by CWE, which is how cwex 79 --cves counts them.

CNA: CVE Numbering Authority

A CNA is an organization authorized by the CVE Program to assign CVE IDs and publish CVE records for vulnerabilities within its scope. Scopes are agreed with the program so that CNAs do not overlap:

  • Vendors cover their own products. The Apache Software Foundation security team is the CNA for all Apache projects (Log4j, HTTP Server, Tomcat…); Microsoft, Red Hat and Google (Chrome) are other examples.
  • Coordinators and researchers cover what they handle.
  • The program also has a CNA of last resort for vulnerabilities outside every other scope.

The CNA writes the CNA container of the record: the description, the affected products and versions, references and, optionally, the problem type (CWE) and severity metrics (CVSS or its own scale).

Record CNA CWE in the CNA container Severity in the CNA container
Log4Shell apache CWE-502, CWE-400, CWE-20 Text only: critical
Heartbleed redhat None (n/a) None

So the first CWE of a CVE usually comes from the CNA itself, not from later enrichment. Older records, like Heartbleed's, often lack one. In CWE Explorer this source is labeled with the CNA's short name: apache (CNA).

ADP: Authorized Data Publisher

An ADP is an organization authorized to enrich existing CVE records with a container of its own. An ADP cannot change what the CNA wrote: its data sits next to the CNA's, labeled with the ADP's name. Both example records have two ADP containers:

  • CISA-ADP, CISA's "Vulnrichment" program. CISA is the U.S. Cybersecurity and Infrastructure Security Agency. Its container can include:
  • SSVC (Stakeholder-Specific Vulnerability Categorization) decision points: Exploitation (none, PoC, active), Automatable and Technical Impact.
  • A KEV entry, when the CVE is in CISA's catalog of Known Exploited Vulnerabilities, with the date it was added.
  • Missing data that the CNA did not provide: CVSS scores, CWEs and affected platforms (CPE).
  • CVE, the "CVE Program Container". It adds references collected by the program: 53 for Log4Shell, 129 for Heartbleed.

What CISA added in the two examples:

Record CWE CVSS SSVC KEV
Log4Shell None (the CNA had given three) 3.1: 10.0 Critical Exploitation active, Automatable yes, Technical Impact total (assessed 2025-02-04) Added 2021-12-10
Heartbleed CWE-125 Out-of-bounds Read 3.1: 7.5 High Exploitation active, Automatable yes, Technical Impact partial (assessed 2025-02-07) Added 2022-05-04

For Heartbleed, CISA's container is where the CVE record gets its only CWE. In CWE Explorer this source is labeled with the ADP's short name: CISA-ADP.

NVD: National Vulnerability Database

The NVD is the U.S. government's vulnerability database, run by NIST (National Institute of Standards and Technology). It ingests every record of the CVE List and adds its own analysis:

  • CVSS scores calculated by NIST's analysts.
  • CWEs chosen by those analysts, plus two placeholders for when no CWE can be assigned: NVD-CWE-noinfo and NVD-CWE-Other. The CWE catalog offers a reduced set for this purpose, view 1003 (Weaknesses for Simplified Mapping of Published Vulnerabilities): about 130 commonly seen weaknesses in two levels, which the view's own description proposes for sources such as the NVD. The NVD's CWEs for both examples, CWE-917 and CWE-125, belong to it.
  • CPE configurations: machine-readable lists of the affected products and versions.
  • CISA's KEV data, in fields such as cisaExploitAdd and cisaActionDue.

Three things are easy to miss:

  1. The NVD's analysis can disagree with the CNA's. For Log4Shell the NVD assigns CWE-917 (expression language injection), which Apache's record does not mention.
  2. The NVD's analysis stays in the NVD. It is published through the NVD website and API, not added to the CVE record. That is why CWE Explorer queries both.
  3. Analysis takes time. Each NVD entry has a vulnStatus (Received, Awaiting Analysis, Analyzed, Deferred…). Until a CVE is analyzed, the NVD only shows what the CNA and the ADPs provided. Both examples here are Analyzed.

The NVD's API also repeats the CNA's and ADPs' CWEs, tagged with their own source (security@apache.org for Apache). CWE Explorer reads those directly from the CVE record and keeps only the NVD's own, labeled NVD.

The CWE catalog

CWE (Common Weakness Enumeration) is a community-developed list of the types of weakness found in software and hardware, maintained by MITRE. Where a CVE says "this product had this flaw", a CWE says "this is the kind of mistake that causes such flaws":

CVE (one vulnerability) CWE (the type of weakness)
CVE-2021-44228, Log4Shell in Apache Log4j2 CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement
CVE-2014-0160, Heartbleed in OpenSSL CWE-125 Out-of-bounds Read

The catalog (version 5.0) contains 984 weakness entries, 431 groupings (formerly categories) and 62 views. View 1000 arranges the weaknesses in the hierarchy that CWE Explorer draws. Each entry has a formal name and, often, alternate terms: "Cross-site Scripting" and "XSS" are alternate terms of CWE-79, whose formal name is Improper Neutralization of Input During Web Page Generation.

The catalog relates to CVEs in two ways:

  • As a dictionary. CNAs, ADPs and the NVD all use CWE IDs to classify CVEs. Each entry also says whether it should be used for that purpose: its Vulnerability Mapping Notes mark it as Allowed, Allowed-with-Review, Discouraged or Prohibited.
  • As a source of links of its own. Many entries cite real CVEs as observed examples. CWE-917 cites Log4Shell; CWE-125, CWE-126, CWE-130 and CWE-240 cite Heartbleed. In total, 2,202 CVEs are cited. These are illustrations chosen by the catalog's authors, not official assignments. CWE Explorer labels them CWE catalog (observed example).

How they connect

The roles do not form a strict chain. Once a CNA publishes a record, the ADPs and the NVD work on it independently, and at different times:

sequenceDiagram
    participant A as Apache (CNA)
    participant L as CVE record (cve.org)
    participant C as CISA (ADP)
    participant N as NVD (NIST)
    participant W as CWE catalog
    A->>L: publishes CVE-2021-44228 (2021-12-10)<br/>CWE-502, 400, 20 · severity "critical"
    L->>N: record ingested (2021-12-10)
    N->>N: own analysis: CVSS 3.1 10.0 · CWE-917 · CPE
    C->>L: ADP container: CVSS 3.1 10.0 · KEV (added 2021-12-10)<br/>SSVC: exploitation active (assessed 2025-02-04)
    W->>W: CWE-917 cites CVE-2021-44228 as an observed example
    Note over L,W: cwex reads the record (CNA + ADPs), the NVD and the catalog,<br/>and shows every CWE link with its source
The life of Log4Shell (CVE-2021-44228) across the ecosystem. After Apache publishes the record, the NVD, CISA and the CWE catalog each add their view independently and at different times.
  1. A CNA assigns the CVE ID and publishes the record with its own container, often including a CWE and a severity.
  2. ADPs add their containers to the same record, without touching the CNA's. CISA adds SSVC and KEV information, and fills in CVSS, CWE or CPE when they are missing.
  3. The NVD ingests the record and publishes its own analysis (CVSS, CWE, CPE) in its database, which may differ from the CNA's.
  4. The CWE catalog provides the IDs everyone uses to classify the weakness, and cites some CVEs as examples of its entries.

In short: the CVE identifies a vulnerability, the CNA describes it, ADPs such as CISA enrich it, the NVD analyzes it, and CWE classifies the underlying weakness. Because several parties classify the same CVE, they do not always agree. That is why CWE Explorer shows every link with its source instead of picking one.

How each role appears in CWE Explorer

Role Label in CWE Explorer Read from Contributes
CNA <short name> (CNA), for example apache (CNA) CVE.org API, containers.cna Description, dates, CWE links, CVSS
ADP Its short name, for example CISA-ADP CVE.org API, containers.adp[] CWE links, CVSS, CISA's SSVC assessment and KEV entry
NVD NVD NVD API, entries with source nvd@nist.gov CWE links (including NVD-CWE-*), CVSS, KEV dates; for --cves, the CVEs of a CWE
CWE catalog CWE catalog (observed example) The downloaded catalog, Observed_Examples Reverse links: CWEs that cite the CVE

One more organization appears outside these roles: FIRST, the Forum of Incident Response and Security Teams, publishes the EPSS score (the probability that a CVE is exploited in the next 30 days), shown in the EPSS line of the CVE card. How KEV, SSVC and EPSS are shown is explained in Exploitation signals.

Common misconceptions

  • "The CWE comes from CISA or the NVD." Often it comes from the CNA first: Apache assigned three CWEs to Log4Shell. CISA's Vulnrichment mostly fills gaps, like Heartbleed's missing CWE.
  • "The NVD just republishes the CVE." It republishes it and adds an independent analysis, which can disagree with the CNA (Log4Shell: CWE-917).
  • "An ADP corrects the CNA's data." It cannot. Its data is added next to the CNA's, and both remain visible.
  • "The process is sequential." After publication, ADPs and the NVD act independently. CISA's SSVC assessment of Log4Shell is dated 2025-02-04, more than three years after the CVE was published and ingested by the NVD.
  • "The CWE catalog is only a dictionary." It also cites real CVEs as observed examples, the only CWE → CVE information inside the catalogs themselves. Counting every CVE of a CWE needs the NVD (cwex 79 --cves).
  • "CWE-79 is called Cross-Site Scripting." That is an alternate term; the formal name is Improper Neutralization of Input During Web Page Generation. Searching by common names is proposal 12 in WIP/.