CVE - Request CVE IDs

Power user
shortcuts:

Request CVE IDs

CVE prioritizes the assignment of CVE Identifiers (CVE IDs) for the products, vendors, and product categories listed below, but you may request a CVE ID for any vulnerability.

New users, follow these steps to request CVE IDs:

Locate the correct CVE Numbering Authority (CNA) whose scope includes the product affected by the vulnerability in the Participating CNAs table below.
Contact the CNA specified below using the contact method provided.
If the product affected by the vulnerability is not covered by a CNA listed below, please contact the CVE Program Root CNA.

Participating CNAs

CNAs are listed alphabetically:

A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z

Product, Vendor, or Product Category Name	Scope	CNA Contact Email and/or Webpage (if applicable)	CNA Type*
MITRE Corporation	All vulnerabilities, and Open Source software product vulnerabilities, not already covered by a CNA listed on this page	MITRE CVE Request web form	Program Root CNA

Adobe Systems Incorporated	Adobe issues only	[email protected] Adobe security page	Vendors and Projects
Airbus	All Airbus products (supported products and end-of-life/end-of-service products), as well as vulnerabilities in third-party software discovered by Airbus that are not in another CNA’s scope	[email protected] Airbus Vulnerability Handling and Disclosure	Vendors and Projects Vulnerability Researchers
Alibaba, Inc.	Projects listed on its Alibaba GitHub website only	[email protected] Alibaba website Alibaba GitHub website	Vendors and Projects
Android (associated with Google Inc. or Open Handset Alliance)	Android issues only	[email protected] Android security page	Vendors and Projects
Apache Software Foundation	All Apache Software Foundation issues	[email protected] Apache security page	Vendors and Projects
Apple Inc.	Apple issues only	[email protected] Apple security page	Vendors and Projects
Appthority	All Appthority products, as well as vulnerabilities in third-party software discovered by Appthority that are not in another CNA’s scope	[email protected] Appthority Disclosure Policy Appthority Advisories	Vendors and Projects Vulnerability Researchers
Asea Brown Boveri Ltd. (ABB)	ABB issues only	[email protected] ABB Disclosure Policy ABB Advisories	Vendors and Projects
Atlassian	All Atlassian products, as well as Atlassian-maintained projects hosted on https://bitbucket.org/atlassian and https://github.com/atlassian/	[email protected]	Vendors and Projects
Autodesk	All currently supported Autodesk Applications and Cloud Services	[email protected]	Vendors and Projects
Avaya, Inc.	All Avaya products	[email protected] Avaya Disclosure Policy Avaya Advisories	Vendors and Projects
Bitdefender	All Bitdefender products, as well as vulnerabilities in third-party software discovered by Bitdefender that are not in another CNA’s scope	[email protected] Bitdefender Disclosure Policy Bitdefender Advisories	Vendors and Projects Vulnerability Researchers
BlackBerry	BlackBerry and Good product issues only	[email protected] Blackberry security page	Vendors and Projects
Robert Bosch GmbH	Bosch products only	[email protected] Bosch Disclosure Policy Bosch Advisories	Vendors and Projects
Brocade Communications Systems, LLC	Brocade products only	[email protected] Brocade security page	Vendors and Projects
Canonical Ltd.	All Canonical issues (including Ubuntu Linux) only	[email protected] Ubuntu security page	Vendors and Projects
CA Technologies - A Broadcom Company	CA Technologies issues only	[email protected] CA Technologies Disclosure Policy CA Technologies Advisories	Vendors and Projects
CERT/CC	Vulnerability assignment related to its vulnerability coordination role	[email protected] CERT/CC contact page	National and Industry CERTs
Check Point Software Technologies Ltd.	Check Point Security Gateways product line only, and any vulnerabilities discovered by Check Point that are not in another CNA’s scope	[email protected]	Vendors and Projects Vulnerability Researchers
Cisco Systems, Inc.	All Cisco and Duo Security products, and any third-party research targets that are not in another CNA’s scope	[email protected] Cisco Disclosure Policy Cisco Advisories [email protected] Duo Security Disclosure Policy Duo Security Advisories	Vendors and Projects Vulnerability Researchers
Cloudflare, Inc.	All Cloudflare products, projects hosted at https://github.com/cloudflare/, and any vulnerabilities discovered by Cloudflare that are not in another CNA’s scope	[email protected] Cloudflare Disclosure Policy Cloudflare Advisories	Vendors and Projects
CyberSecurity Philippines - CERT	Vulnerability assignment related to its vulnerability coordination role that are not in another CNA’s scope	[email protected] CyberSecurity Philippines - CERT Disclosure Policy CyberSecurity Philippines - CERT Advisories	National and Industry CERTs
Dahua Technologies	Dahua issues only	[email protected] Dahua security page	Vendors and Projects
Debian GNU/Linux	Debian issues only	[email protected] Debian security page	Vendors and Projects
Dell	Dell, Dell EMC, RSA, and VCE issues only	[email protected] Dell security page	Vendors and Projects
Document Foundation, The	Projects within The Document Foundation only, e.g., LibreOffice, LibreOffice Online; The Document Foundation discourages reporting denial of service bugs as security issues	[email protected] The Document Foundation Disclosure Policy The Document Foundation Advisories	Vendors and Projects
Drupal.org	All projects hosted under drupal.org only	[email protected] Drupal security advisories page	Vendors and Projects
Eaton	Eaton issues only	[email protected] Eaton Disclosure Policy Eaton Advisories	Vendors and Projects
Eclipse Foundation	Eclipse IDE and the Eclipse Foundation's eclipse.org, polarysys.org, and locationtech.org open source projects only	[email protected] Eclipse security page	Vendors and Projects
Elastic	Elasticsearch, Kibana, Beats, Logstash, X-Pack, and Elastic Cloud Enterprise products only	[email protected] Elastic security page	Vendors and Projects
F5 Networks	F5 issues only	[email protected] F5 Vulnerability Response Policy	Vendors and Projects
Facebook, Inc.	Facebook-supported open source projects, mobile apps, and other software, as well as vulnerabilities in third-party software discovered by Facebook that are not in another CNA’s scope; see: https://www.facebook.com/whitehat and https://github.com/facebook/	Facebook security page	Vendors and Projects Vulnerability Researchers
Fedora Project	Fedora Project issues only	Fedora Bug Report page	Vendors and Projects
Flexera Software LLC	All Flexera products, and vulnerabilities discovered by Secunia Research that are not in another CNA’s scope	[email protected]	Vendors and Projects Vulnerability Researchers
floragunn GmbH	All issues related to Search Guard only	[email protected] floragunn Disclosure Policy floragunn Advisories	Vendors and Projects
Forcepoint	Forcepoint products only	[email protected] Forcepoint security page	Vendors and Projects
Fortinet, Inc.	Fortinet issues only	[email protected]	Vendors and Projects
FreeBSD	Primarily FreeBSD issues only	[email protected]	Vendors and Projects
GitHub, Inc.	All libraries and products hosted on github.com in a public repository, unless they are otherwise covered by another CNA	[email protected] GitHub Disclosure Policy GitHub Advisories	Vendors and Projects
Google Inc.	Chrome and Chrome OS issues, and projects that are not in another CNA’s scope	Report vulnerabilities: [email protected] Questions about Google’s CVE Entries: [email protected] Google app security page	Vendors and Projects
HackerOne	Provides CVE IDs for its customers as part of its bug bounty and vulnerability coordination platform	[email protected] HackerOne contact page	Bug Bounty Programs
Hangzhou Hikvision Digital Technology Co., Ltd.	All Hikvision Internet of Things (IoT) products including cameras and digital video recorders (DVRs)	[email protected]	Vendors and Projects
HCL Software	All HCL products only	[email protected] HCL Disclosure Policy HCL Advisories	Vendors and Projects
Hewlett Packard Enterprise (HPE)	HPE issues only	[email protected]	Vendors and Projects
Hillstone Networks, Inc.	All Hillstone products only	[email protected] Hillstone Disclosure Policy Hillstone Advisories	Vendors and Projects
HP Inc.	HP Inc. issues only	[email protected]	Vendors and Projects
Huawei Technologies	Huawei issues only	[email protected] Huawei security page	Vendors and Projects
IBM Corporation	All IBM products, as well as vulnerabilities in third-party software discovered by IBM X-Force Red that are not in another CNA’s scope	[email protected]	Vendors and Projects Vulnerability Researchers
ICS-CERT	Infrastructure sector control systems	[email protected]	National and Industry CERTs
Intel Corporation	Intel branded products and technologies and Intel managed open source projects	[email protected] Intel security page	Vendors and Projects
Internet Systems Consortium (ISC)	All ISC.org projects	[email protected] ISC report a bug page	Vendors and Projects
Jenkins Project	Jenkins and Jenkins plugins distributed by the Jenkins Project (listed on plugins.jenkins.io) only	[email protected] Jenkins Project Disclosure Policy Jenkins Project Advisories	Vendors and Projects
Johnson Controls	Johnson Controls products only	[email protected] Johnson Controls Disclosure Policy Johnson Controls Advisories	Vendors and Projects
JPCERT/CC	Vulnerability assignment related to its vulnerability coordination role	[email protected] JPCERT/CC contact page	Root CNA National and Industry CERTs
Juniper Networks, Inc.	Juniper issues only	[email protected] Juniper security page	Vendors and Projects
Kaspersky	Kaspersky B2C and B2B products, as well as vulnerabilities discovered in third-party software not in another CNA’s scope	[email protected]	Vendors and Projects Vulnerability Researchers
KrCERT/CC	Vulnerability assignment related to its vulnerability coordination role	[email protected]	National and Industry CERTs
Kubernetes	Kubernetes issues only	[email protected] Kubernetes Disclosure Policy Kubernetes Advisories	Vendors and Projects
Larry Cashdollar	Third-party products he researches	[email protected]	Vulnerability Researchers
Lenovo Group Ltd.	Lenovo general-purpose computers, software for general-purpose operating systems, mobile devices, enterprise storage, and networking products only	[email protected]	Vendors and Projects
MarkLogic Corporation	MarkLogic issues only	[email protected]	Vendors and Projects
McAfee	All McAfee products, as well as vulnerabilities in third-party software discovered by McAfee ATR that are not in another CNA’s scope	[email protected] McAfee Advisories	Vendors and Projects Vulnerability Researchers
Micro Focus International	All Attachmate, Borland, Gwava, Micro Focus, NetIQ, Novell, and Serena products, as well as all former HP Enterprise software suites	[email protected] Micro Focus Disclosure Policy Micro Focus Advisories	Vendors and Projects
Microsoft Corporation	Microsoft issues only	[email protected] Microsoft security page	Vendors and Projects
MITRE Corporation	All vulnerabilities, and Open Source software product vulnerabilities, not already covered by a CNA listed on this page	MITRE CVE Request web form	Program Root CNA
MongoDB, Inc.	MongoDB products only	[email protected] MongoDB Disclosure Policy MongoDB Advisories	Vendors and Projects
Mozilla Corporation	Mozilla issues only	[email protected] Mozilla security page	Vendors and Projects
Naver Corporation	Naver products only, except Line products	[email protected] Naver Disclosure Policy Naver Advisories	Vendors and Projects
NetApp, Inc.	All NetApp products as well as projects hosted on https://github.com/netapp	[email protected] NetApp security page	Vendors and Projects
Netflix, Inc.	Current versions of Netflix Mobile Streaming Application for iOS, Android, and Windows Mobile, plus all Netflix Open Source projects hosted on https://github.com/Netflix and https://github.com/spinnaker	[email protected]	Vendors and Projects
Node.js	All actively developed versions of software developed under the Node.js project on https://github.com/nodejs	[email protected] Node.js security page	Vendors and Projects
NVIDIA Corporation	NVIDIA issues only	[email protected] NVIDIA security page	Vendors and Projects
Objective Development Software GmbH	Objective Development issues only	Objective Development security page	Vendors and Projects
Odoo	Odoo issues only	[email protected] Odoo Disclosure Policy Odoo Advisories	Vendors and Projects
OpenSSL Software Foundation	OpenSSL software projects only	[email protected] OpenSSL contact web page	Vendors and Projects
OPPO Mobile Telecommunication Corp., Ltd.	OPPO devices only	[email protected] OPPO Disclosure Policy OPPO Advisories	Vendors and Projects
Oracle	Oracle Premier and Extended Support product versions per Oracle’s Lifetime Support Policy	[email protected] Oracle security page	Vendors and Projects
OTRS AG	Vulnerabilities for OTRS and ((OTRS)) Community Edition and modules only	[email protected] OTRS Disclosure Policy OTRS Advisories	Vendors and Projects
Palo Alto Networks, Inc.	All Palo Alto Networks products, and vulnerabilities discovered by Palo Alto Networks that are not in another CNA’s scope	[email protected] Palo Alto Networks Disclosure Policy Palo Alto Networks Advisories	Vendors and Projects Vulnerability Researchers
PHP Group	Vulnerabilities in PHP code (code in https://github.com/php/php-src) only	[email protected] PHP Group Disclosure Policy PHP Group Advisories	Vendors and Projects
Pivotal Software, Inc.	Pivotal, Spring, and Cloud Foundry issues only	[email protected] Pivotal Disclosure Policy, Cloud Foundry Disclosure Policy Pivotal Advisories, Spring Advisories, Cloud Foundry Advisories	Vendors and Projects
Puppet	All Puppet products, as well as all projects on https://github.com/puppetlabs	[email protected] Puppet security page	Vendors and Projects
QNAP Systems, Inc.	QNAP QTS, QES, and QVR products as well as its mobile apps and utilities	[email protected]	Vendors and Projects
Qualcomm, Inc.	Qualcomm and Snapdragon issues only	[email protected]	Vendors and Projects
Rapid7, Inc.	All Rapid7 products, and vulnerabilities discovered by Rapid7 that are not in another CNA’s scope	[email protected] Rapid7 security page	Vendors and Projects Vulnerability Researchers
Red Hat, Inc.	Linux issues only	[email protected] Red Hat security page	Vendors and Projects
Salesforce, Inc.	Salesforce products only	[email protected] Salesforce Disclosure Policy Salesforce Advisories	Vendors and Projects
SAP SE	All SAP products	[email protected]	Vendors and Projects
Schneider Electric SE	All Schneider Electric products, including Proface, Pelco, APC, and Eurotherm	[email protected] Schneider Electric security page	Vendors and Projects
Siemens	Siemens issues only	[email protected] Siemens security page	Vendors and Projects
Snyk	Vulnerabilities in third-party products discovered by Snyk only	[email protected] Snyk Disclosure Policy Snyk Advisories	Vulnerability Researchers
SonicWall, Inc.	SonicWall issues only	[email protected] SonicWall Disclosure Policy SonicWall Advisories	Vendors and Projects
Splunk Inc.	Splunk products only	[email protected] Splunk Disclosure Policy Splunk Advisories	Vendors and Projects
SUSE	All SUSE Enterprise products and openSUSE software	[email protected] SUSE Disclosure Policy SUSE Advisories SUSE Advisories by CVE ID	Vendors and Projects
Symantec Corporation	Symantec issues only	[email protected] Symantec security page	Vendors and Projects
Synology Inc.	Synology issues only	[email protected] Synology security page	Vendors and Projects
Talos	Third-party products it researches	[email protected] Talos web page	Vulnerability Researchers
Tenable Network Security, Inc.	Tenable products and third-party products they research not covered by another CNA	[email protected] Tenable security page	Vendors and Projects
360 Security Technology, Inc.	360 Total Security, 360 Safeguard, 360 Mobile Safe, and 360 Safe Router products, and vulnerabilities in third-party products discovered by 360 that are not covered by another CNA	[email protected] 360 Disclosure Policy 360 Advisories	Vendors and Projects Vulnerability Researchers
TIBCO Software Inc.	TIBCO, Talarian, Spotfire, Data Synapse, Foresight, Kabira, Proginet, LogLogic, StreamBase, JasperSoft, and Mashery products/brands only	[email protected]	Vendors and Projects
Tigera, Inc.	All vulnerabilities for Calico and all of Tigera’s products only	[email protected] Tigera Disclosure Policy Tigera Advisories	Vendors and Projects
Trend Micro, Inc.	Trend Micro supported products and end-of-life products issues only	[email protected] Trend Micro security page	Vendors and Projects
TWCERT/CC	Vulnerability assignment related to its vulnerability coordination role	[email protected] Chinese: TWCERT/CC Disclosure Policy TWCERT/CC Advisories English: TWCERT/CC Disclosure Policy TWCERT/CC Advisories	National and Industry CERTs
VMware	VMware issues only	[email protected]	Vendors and Projects
Yandex N.V.	Yandex issues only	[email protected]	Vendors and Projects
Zephyr Project	Zephyr project components, and vulnerabilities that are not in another CNA’s scope	[email protected]	Vendors and Projects
Zero Day Initiative	Products and projects covered by its bug bounty programs that are not in another CNA’s scope	[email protected] ZDI contact page	Bug Bounty Programs
ZTE Corporation	ZTE products only	[email protected]	Vendors and Projects

* Key for CNA Types:

Bug Bounty Programs - assigns CVE IDs to products and projects that utilize the Bug Bounty service’s product offerings.
National and Industry CERTs - performs incident response and vulnerability disclosure services for nations or industries. They may assign CVE IDs as part of their role and scope.
Program Root CNA - oversees the CNA program.
Root CNA - manages a group of sub-CNAs within a given domain or community.
Vendors and Projects - assigns CVE IDs for vulnerabilities found in their own products and projects.
Vulnerability Researchers - assigns CVE IDs to products and projects upon which they perform vulnerability analysis.

CVE Program Root CNA PGP Key

Please use our CVE Request web form to request CVE IDs directly from the CVE Program Root CNA (currently MITRE). Upon completion of the form, you will receive a confirmation email message that includes a reference number. Any additional communications related to that request will be done through email using the same subject line as the confirmation email.

View our web form help.

A PGP key is available for encrypted communications:

Key ID:		7C2D8720
Fingerprint:	9C98 A172 9BE8 01B2 FF6D 14BA 7496 C064 7C2D 8720
Key size:	4096
Public key:	Click to download

NOTE: PGP key updated March 2018

For questions, or assistance about how to use the information on this page, please contact us.