Inside the CVE List: How Vulnerabilities Get Their ID Cards

Thousands of software bugs are discovered every day around the world. But turning these bugs into an official, globally recognized CVE code (such as CVE-2026-1234) is a rigorous and coordinated process.

Who Maintains the CVE List?
The Master CVE List is managed by the MITRE Corporation, a non-profit organization, a federally funded research center in the United States. The program is funded by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). MITRE is responsible for the integrity of the database and maintaining the rules.

What are CVE Numbering Authorities (CNAs)?
Since MITRE cannot register all the software vulnerabilities in the world on its own, it delegates the authority to assign IDs to a global network of partners called CVE Numbering Authorities (CNAs).

Who are the CNAs?
Big Tech Companies: Giants like Microsoft, Apple, Google, Cisco assign CVE IDs to vulnerabilities found in their products.
Security Companies and Bug Bounty Platforms: For example, HackerOne or cybersecurity firms can provide code for vulnerabilities they find during research.
Open Source Projects: Groups like the Linux Kernel or Apache manage their own ecosystems.
If a vulnerability finder (for example, a cybersecurity student or pentester) finds a vulnerability in a product of a small company that is not a CNA, they can contact MITRE directly and request a CVE ID.

Conclusion
Thanks to MITRE and the global CNA network, vulnerability reporting is not done haphazardly, but in a coordinated manner. This system allows programmers to develop patches and protects users from attacks.