{"schema":"https://ver.cy/schemas/card/1.0.0","id":"vr.wm-sft-006","code":"wm-sft-006-vulnerability-record","url":"https://ver.cy/models/wm-sft-006-vulnerability-record/","name":"Vulnerability Record","alternateNames":["S8"],"kind":"world-model","status":"published","version":"0.3.0-research.1","language":"en","classifiers":{"family":"World Models","category":"Information and virtual systems","entryKind":"aggregate","plane":"","domain":["INF.SFT.VUL"],"industry":["Cross-industry"],"navPath":"NAV.INF.SFT.VUL","tags":["vulnerability","record","inf.sft.vul"],"facets":{}},"whatItIs":"Owns vulnerability record identity and aliases, source assertion containers, descriptions, weakness mappings, affected product and version assertions, discovery and disclosure evidence, credits, references, severity and exploitation assessments, lifecycle changes, quality, access and provenance. Product, package, deployed asset, advisory, patch, remediation task, exploit, threat, risk decision and incident masters remain external.","purpose":"Represent an authority-qualified security vulnerability record, its affected product assertions, evidence, assessments and disclosure lifecycle independent of storage and interface format.","scope":{"in":["Authoritative identity, aliases, source containers, descriptions, problem types, affected products, platforms, versions and configurations","Discovery, reporter and validation evidence, coordination timeline, references, credits, CVSS and time-varying exploitation or prioritization signals","Remediation and exposure links, corrections, rejection, withdrawal, supersession, interoperability, quality, access, retention and safe operations"],"out":["Product, package, software component, deployed asset, advisory, patch, fix, remediation task or inventory master lifecycle","Exploit, threat actor, campaign, indicator, cyber incident, control, organizational risk or risk-acceptance master lifecycle","Exploit generation, unauthorized scanning, universal risk scoring, automated disclosure decisions or guaranteed cross-schema equivalence"],"boundaries":[{"neighbor":"Weakness / CWE class","distinction":"A weakness class describes a recurring error pattern; a vulnerability record describes one source-qualified flaw or exposure instance that may map to one or more weakness classes."},{"neighbor":"Product / Package / Component","distinction":"Product identity and version ordering remain external; this model owns source-qualified affectedness assertions about them."},{"neighbor":"Deployed Asset Exposure","distinction":"Product-level affectedness does not prove that a specific deployed asset contains, reaches or exposes the vulnerable configuration."},{"neighbor":"Security Advisory / Remediation","distinction":"An advisory can group vulnerabilities, products and remedies; fixes, workarounds and remediation execution retain separate identity and lifecycle."},{"neighbor":"Exploit / Threat / Cyber Incident","distinction":"A vulnerability may enable exploitation and be referenced by threat or incident records, but exploit and incident evidence have independent identity, authority and lifecycle."}]},"distinguishingFeatures":["Models a published vulnerability with its source assertions, not the weakness class it instances.","Keeps CNA, vendor and enrichment claims in separate containers rather than one merged truth.","Separates the vulnerability from exposure on deployed assets, advisories and exploits.","Holds severity and exploitation signals with source, method and scoring time."],"structure":{"bundles":[{"id":"vulnerability-identity-record-authority-and-class","name":"Vulnerability identity, record authority and class","description":"Identifies one vulnerability record and preserves source authority, aliases and assertion containers.","layers":[{"id":"record-identity-aliases-and-boundary","name":"Record identity, aliases and boundary","description":"Stable identifiers and relations among same, upstream and related vulnerability records.","findings":[{"id":"authoritative-identifier-namespace-alias-resolver-and-collision","name":"Authoritative identifier, namespace, alias, resolver and collision","description":"Master identifier, assigning namespace, aliases, resolver, reservation status, predecessor, duplicate and collision evidence.","questions":[{"text":"What identifiers, source containers, classes, scope and values define authoritative identifier, namespace, alias, resolver and collision?","id":"authoritative-identifier-namespace-alias-resolver-and-collision-q01","kind":"identity"},{"text":"Which authority, evidence, method, event time and knowledge time support authoritative identifier, namespace, alias, resolver and collision?","id":"authoritative-identifier-namespace-alias-resolver-and-collision-q02","kind":"evidence"},{"text":"How may authoritative identifier, namespace, alias, resolver and collision be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"authoritative-identifier-namespace-alias-resolver-and-collision-q03","kind":"validation"}]},{"id":"same-vulnerability-upstream-related-split-and-merge-boundary","name":"Same vulnerability, upstream, related, split and merge boundary","description":"Source-qualified relation kind, direction, matching criteria, affected-component scope, split or merge rationale and uncertainty.","questions":[{"text":"What identifiers, source containers, classes, scope and values define same vulnerability, upstream, related, split and merge boundary?","id":"same-vulnerability-upstream-related-split-and-merge-boundary-q01","kind":"relationship"},{"text":"Which authority, evidence, method, event time and knowledge time support same vulnerability, upstream, related, split and merge boundary?","id":"same-vulnerability-upstream-related-split-and-merge-boundary-q02","kind":"authority"},{"text":"How may same vulnerability, upstream, related, split and merge boundary be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"same-vulnerability-upstream-related-split-and-merge-boundary-q03","kind":"exception"}]}]},{"id":"record-container-authorship-and-version","name":"Record container, authorship and version","description":"Separates authoritative source containers and immutable versions.","findings":[{"id":"cna-adp-nvd-vendor-ecosystem-and-database-assertion-container","name":"CNA, ADP, NVD, vendor, ecosystem and database assertion container","description":"Container kind, source organization, role, authority, schema version, covered claims, original locator and signature or digest.","questions":[{"text":"What identifiers, source containers, classes, scope and values define cna, adp, nvd, vendor, ecosystem and database assertion container?","id":"cna-adp-nvd-vendor-ecosystem-and-database-assertion-container-q01","kind":"ownership"},{"text":"Which authority, evidence, method, event time and knowledge time support cna, adp, nvd, vendor, ecosystem and database assertion container?","id":"cna-adp-nvd-vendor-ecosystem-and-database-assertion-container-q02","kind":"provenance"},{"text":"How may cna, adp, nvd, vendor, ecosystem and database assertion container be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"cna-adp-nvd-vendor-ecosystem-and-database-assertion-container-q03","kind":"access"}]},{"id":"record-version-state-published-modified-rejected-and-withdrawn","name":"Record version, state, published, modified, rejected and withdrawn","description":"Version identifier, lifecycle state, state reason, predecessor, publication and modification times, withdrawal or rejection and retained history.","questions":[{"text":"What identifiers, source containers, classes, scope and values define record version, state, published, modified, rejected and withdrawn?","id":"record-version-state-published-modified-rejected-and-withdrawn-q01","kind":"lifecycle"},{"text":"Which authority, evidence, method, event time and knowledge time support record version, state, published, modified, rejected and withdrawn?","id":"record-version-state-published-modified-rejected-and-withdrawn-q02","kind":"temporal"},{"text":"How may record version, state, published, modified, rejected and withdrawn be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"record-version-state-published-modified-rejected-and-withdrawn-q03","kind":"retention"}]}]}]},{"id":"description-weakness-and-affected-product","name":"Description, weakness and affected product","description":"Describes the flaw and source-qualified affected product and version assertions.","layers":[{"id":"descriptions-problem-types-and-root-cause","name":"Descriptions, problem types and root cause","description":"Captures multilingual statements and classifier mappings without turning inference into fact.","findings":[{"id":"summary-description-language-supporting-media-and-redaction","name":"Summary, description, language, supporting media and redaction","description":"Plain-language and technical descriptions, language, media type, value, redaction markers, source, audience and version.","questions":[{"text":"What identifiers, source containers, classes, scope and values define summary, description, language, supporting media and redaction?","id":"summary-description-language-supporting-media-and-redaction-q01","kind":"definition"},{"text":"Which authority, evidence, method, event time and knowledge time support summary, description, language, supporting media and redaction?","id":"summary-description-language-supporting-media-and-redaction-q02","kind":"quality"},{"text":"How may summary, description, language, supporting media and redaction be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"summary-description-language-supporting-media-and-redaction-q03","kind":"security"}]},{"id":"cwe-problem-type-root-cause-mechanism-and-prerequisite","name":"CWE problem type, root cause, mechanism and prerequisite","description":"Versioned CWE or other classifier reference, mapping method, weakness mechanism, prerequisites, confidence and disputed mappings.","questions":[{"text":"What identifiers, source containers, classes, scope and values define cwe problem type, root cause, mechanism and prerequisite?","id":"cwe-problem-type-root-cause-mechanism-and-prerequisite-q01","kind":"classification"},{"text":"Which authority, evidence, method, event time and knowledge time support cwe problem type, root cause, mechanism and prerequisite?","id":"cwe-problem-type-root-cause-mechanism-and-prerequisite-q02","kind":"process"},{"text":"How may cwe problem type, root cause, mechanism and prerequisite be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"cwe-problem-type-root-cause-mechanism-and-prerequisite-q03","kind":"interoperability"}]}]},{"id":"products-platforms-versions-and-status","name":"Products, platforms, versions and status","description":"Expresses affectedness independently of inventory exposure.","findings":[{"id":"vendor-product-package-module-platform-cpe-purl-and-identity-reference","name":"Vendor, product, package, module, platform, CPE, purl and identity reference","description":"External product or package identity, vendor, module, platform, CPE or purl, ecosystem and source namespace.","questions":[{"text":"What identifiers, source containers, classes, scope and values define vendor, product, package, module, platform, cpe, purl and identity reference?","id":"vendor-product-package-module-platform-cpe-purl-and-identity-reference-q01","kind":"composition"},{"text":"Which authority, evidence, method, event time and knowledge time support vendor, product, package, module, platform, cpe, purl and identity reference?","id":"vendor-product-package-module-platform-cpe-purl-and-identity-reference-q02","kind":"measurement"},{"text":"How may vendor, product, package, module, platform, cpe, purl and identity reference be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"vendor-product-package-module-platform-cpe-purl-and-identity-reference-q03","kind":"validation"}]},{"id":"affected-unaffected-unknown-version-range-configuration-and-justification","name":"Affected, unaffected, unknown version range, configuration and justification","description":"Product-status assertion, range scheme, introduced, fixed, last affected or limit events, configuration constraints, justification and source confidence.","questions":[{"text":"What identifiers, source containers, classes, scope and values define affected, unaffected, unknown version range, configuration and justification?","id":"affected-unaffected-unknown-version-range-configuration-and-justification-q01","kind":"state"},{"text":"Which authority, evidence, method, event time and knowledge time support affected, unaffected, unknown version range, configuration and justification?","id":"affected-unaffected-unknown-version-range-configuration-and-justification-q02","kind":"decision"},{"text":"How may affected, unaffected, unknown version range, configuration and justification be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"affected-unaffected-unknown-version-range-configuration-and-justification-q03","kind":"temporal"}]}]}]},{"id":"discovery-disclosure-evidence-and-coordination","name":"Discovery, disclosure, evidence and coordination","description":"Records accountable discovery and disclosure evidence without publishing restricted exploit detail.","layers":[{"id":"discovery-reporting-evidence-and-confidence","name":"Discovery, reporting, evidence and confidence","description":"Separates reports and observations from validated vulnerability claims.","findings":[{"id":"discoverer-reporter-contact-role-credit-and-attribution","name":"Discoverer, reporter, contact role, credit and attribution","description":"External actor reference, contribution role, requested credit, contact protection, organization, consent and attribution status.","questions":[{"text":"What identifiers, source containers, classes, scope and values define discoverer, reporter, contact role, credit and attribution?","id":"discoverer-reporter-contact-role-credit-and-attribution-q01","kind":"identity"},{"text":"Which authority, evidence, method, event time and knowledge time support discoverer, reporter, contact role, credit and attribution?","id":"discoverer-reporter-contact-role-credit-and-attribution-q02","kind":"evidence"},{"text":"How may discoverer, reporter, contact role, credit and attribution be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"discoverer-reporter-contact-role-credit-and-attribution-q03","kind":"validation"}]},{"id":"discovery-method-report-evidence-reproducer-validation-and-confidence","name":"Discovery method, report, evidence, reproducer, validation and confidence","description":"Method, report reference, restricted evidence locator, affected environment, validation outcome, validator, confidence and disclosure class.","questions":[{"text":"What identifiers, source containers, classes, scope and values define discovery method, report, evidence, reproducer, validation and confidence?","id":"discovery-method-report-evidence-reproducer-validation-and-confidence-q01","kind":"relationship"},{"text":"Which authority, evidence, method, event time and knowledge time support discovery method, report, evidence, reproducer, validation and confidence?","id":"discovery-method-report-evidence-reproducer-validation-and-confidence-q02","kind":"authority"},{"text":"How may discovery method, report, evidence, reproducer, validation and confidence be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"discovery-method-report-evidence-reproducer-validation-and-confidence-q03","kind":"exception"}]}]},{"id":"coordination-timeline-references-and-disclosure","name":"Coordination, timeline, references and disclosure","description":"Maintains event and publication history and typed evidence links.","findings":[{"id":"reservation-vendor-notification-embargo-publication-update-and-knowledge-time","name":"Reservation, vendor notification, embargo, publication, update and knowledge time","description":"Event kind, actor, event time, observation and knowledge time, embargo authority, planned disclosure, actual publication and sequence.","questions":[{"text":"What identifiers, source containers, classes, scope and values define reservation, vendor notification, embargo, publication, update and knowledge time?","id":"reservation-vendor-notification-embargo-publication-update-and-knowledge-time-q01","kind":"ownership"},{"text":"Which authority, evidence, method, event time and knowledge time support reservation, vendor notification, embargo, publication, update and knowledge time?","id":"reservation-vendor-notification-embargo-publication-update-and-knowledge-time-q02","kind":"provenance"},{"text":"How may reservation, vendor notification, embargo, publication, update and knowledge time be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"reservation-vendor-notification-embargo-publication-update-and-knowledge-time-q03","kind":"access"}]},{"id":"advisory-report-fix-evidence-reference-tag-and-integrity","name":"Advisory, report, fix, evidence reference, tag and integrity","description":"Typed URL or document reference, source, role, tags, access class, retrieved version, digest, publication state and trust caveat.","questions":[{"text":"What identifiers, source containers, classes, scope and values define advisory, report, fix, evidence reference, tag and integrity?","id":"advisory-report-fix-evidence-reference-tag-and-integrity-q01","kind":"lifecycle"},{"text":"Which authority, evidence, method, event time and knowledge time support advisory, report, fix, evidence reference, tag and integrity?","id":"advisory-report-fix-evidence-reference-tag-and-integrity-q02","kind":"temporal"},{"text":"How may advisory, report, fix, evidence reference, tag and integrity be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"advisory-report-fix-evidence-reference-tag-and-integrity-q03","kind":"retention"}]}]}]},{"id":"severity-exploitability-and-prioritization-signals","name":"Severity, exploitability and prioritization signals","description":"Stores versioned assessments while preventing severity, exploitation probability, known exploitation and organizational risk from being conflated.","layers":[{"id":"cvss-severity-and-impact-assertions","name":"CVSS severity and impact assertions","description":"Preserves vector, metric group, scope and assessor.","findings":[{"id":"cvss-version-vector-base-threat-environmental-and-supplemental-metrics","name":"CVSS version, vector, Base, Threat, Environmental and Supplemental metrics","description":"CVSS version, full vector, metric groups, score, qualitative rating, calculator version and calculation evidence.","questions":[{"text":"What identifiers, source containers, classes, scope and values define cvss version, vector, base, threat, environmental and supplemental metrics?","id":"cvss-version-vector-base-threat-environmental-and-supplemental-metrics-q01","kind":"definition"},{"text":"Which authority, evidence, method, event time and knowledge time support cvss version, vector, base, threat, environmental and supplemental metrics?","id":"cvss-version-vector-base-threat-environmental-and-supplemental-metrics-q02","kind":"quality"},{"text":"How may cvss version, vector, base, threat, environmental and supplemental metrics be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"cvss-version-vector-base-threat-environmental-and-supplemental-metrics-q03","kind":"security"}]},{"id":"severity-assessor-scope-product-context-time-and-disagreement","name":"Severity assessor, scope, product context, time and disagreement","description":"Assessor identity and role, affected product scope, environment, assertion time, source container, confidence and relation to competing scores.","questions":[{"text":"What identifiers, source containers, classes, scope and values define severity assessor, scope, product context, time and disagreement?","id":"severity-assessor-scope-product-context-time-and-disagreement-q01","kind":"classification"},{"text":"Which authority, evidence, method, event time and knowledge time support severity assessor, scope, product context, time and disagreement?","id":"severity-assessor-scope-product-context-time-and-disagreement-q02","kind":"process"},{"text":"How may severity assessor, scope, product context, time and disagreement be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"severity-assessor-scope-product-context-time-and-disagreement-q03","kind":"interoperability"}]}]},{"id":"exploitation-priority-and-risk-context","name":"Exploitation, priority and risk context","description":"Links time-varying signals and local decisions without inventing one universal priority.","findings":[{"id":"epss-probability-percentile-model-date-window-and-source","name":"EPSS probability, percentile, model date, window and source","description":"Estimated probability, percentile, scoring date, prediction window, model version, source and later-observed outcome reference.","questions":[{"text":"What identifiers, source containers, classes, scope and values define epss probability, percentile, model date, window and source?","id":"epss-probability-percentile-model-date-window-and-source-q01","kind":"composition"},{"text":"Which authority, evidence, method, event time and knowledge time support epss probability, percentile, model date, window and source?","id":"epss-probability-percentile-model-date-window-and-source-q02","kind":"measurement"},{"text":"How may epss probability, percentile, model date, window and source be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"epss-probability-percentile-model-date-window-and-source-q03","kind":"validation"}]},{"id":"kev-known-exploitation-ssvc-decision-priority-and-local-risk-reference","name":"KEV known exploitation, SSVC decision, priority and local risk reference","description":"Catalog or decision source, inclusion evidence, known-ransomware status, decision points, required action, due date and external local-risk decision.","questions":[{"text":"What identifiers, source containers, classes, scope and values define kev known exploitation, ssvc decision, priority and local risk reference?","id":"kev-known-exploitation-ssvc-decision-priority-and-local-risk-reference-q01","kind":"state"},{"text":"Which authority, evidence, method, event time and knowledge time support kev known exploitation, ssvc decision, priority and local risk reference?","id":"kev-known-exploitation-ssvc-decision-priority-and-local-risk-reference-q02","kind":"decision"},{"text":"How may kev known exploitation, ssvc decision, priority and local risk reference be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"kev-known-exploitation-ssvc-decision-priority-and-local-risk-reference-q03","kind":"temporal"}]}]}]},{"id":"remediation-exposure-and-change-lifecycle","name":"Remediation, exposure and change lifecycle","description":"Links remediation and concrete exposure processes while preserving vulnerability record history.","layers":[{"id":"remediation-advisory-fix-and-exposure-links","name":"Remediation, advisory, fix and exposure links","description":"Connects external products, advisories, fixes and deployments.","findings":[{"id":"fix-version-patch-commit-workaround-mitigation-and-remediation-reference","name":"Fix version, patch, commit, workaround, mitigation and remediation reference","description":"External remediation identifier, kind, vendor, product scope, fixed version or commit, availability, restart, caveat and supersession.","questions":[{"text":"What identifiers, source containers, classes, scope and values define fix version, patch, commit, workaround, mitigation and remediation reference?","id":"fix-version-patch-commit-workaround-mitigation-and-remediation-reference-q01","kind":"identity"},{"text":"Which authority, evidence, method, event time and knowledge time support fix version, patch, commit, workaround, mitigation and remediation reference?","id":"fix-version-patch-commit-workaround-mitigation-and-remediation-reference-q02","kind":"evidence"},{"text":"How may fix version, patch, commit, workaround, mitigation and remediation reference be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"fix-version-patch-commit-workaround-mitigation-and-remediation-reference-q03","kind":"validation"}]},{"id":"deployed-asset-exposure-detection-vex-status-and-verification-reference","name":"Deployed asset exposure, detection, VEX status and verification reference","description":"External asset and exposure identifiers, matched product evidence, VEX product status, detection time, verification method and current remediation-state reference.","questions":[{"text":"What identifiers, source containers, classes, scope and values define deployed asset exposure, detection, vex status and verification reference?","id":"deployed-asset-exposure-detection-vex-status-and-verification-reference-q01","kind":"relationship"},{"text":"Which authority, evidence, method, event time and knowledge time support deployed asset exposure, detection, vex status and verification reference?","id":"deployed-asset-exposure-detection-vex-status-and-verification-reference-q02","kind":"authority"},{"text":"How may deployed asset exposure, detection, vex status and verification reference be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"deployed-asset-exposure-detection-vex-status-and-verification-reference-q03","kind":"exception"}]}]},{"id":"record-change-dispute-correction-and-retirement","name":"Record change, dispute, correction and retirement","description":"Keeps append-only changes and justified terminal states.","findings":[{"id":"change-item-field-diff-reason-source-actor-and-predecessor","name":"Change item, field diff, reason, source, actor and predecessor","description":"Changed path, old and new assertion references, reason, responsible actor, authority, predecessor digest, validation and effective time.","questions":[{"text":"What identifiers, source containers, classes, scope and values define change item, field diff, reason, source, actor and predecessor?","id":"change-item-field-diff-reason-source-actor-and-predecessor-q01","kind":"ownership"},{"text":"Which authority, evidence, method, event time and knowledge time support change item, field diff, reason, source, actor and predecessor?","id":"change-item-field-diff-reason-source-actor-and-predecessor-q02","kind":"provenance"},{"text":"How may change item, field diff, reason, source, actor and predecessor be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"change-item-field-diff-reason-source-actor-and-predecessor-q03","kind":"access"}]},{"id":"dispute-correction-rejection-withdrawal-supersession-and-tombstone","name":"Dispute, correction, rejection, withdrawal, supersession and tombstone","description":"Challenge and evidence, resolution authority, corrected successor, rejection or withdrawal reason, tombstone status and retained aliases.","questions":[{"text":"What identifiers, source containers, classes, scope and values define dispute, correction, rejection, withdrawal, supersession and tombstone?","id":"dispute-correction-rejection-withdrawal-supersession-and-tombstone-q01","kind":"lifecycle"},{"text":"Which authority, evidence, method, event time and knowledge time support dispute, correction, rejection, withdrawal, supersession and tombstone?","id":"dispute-correction-rejection-withdrawal-supersession-and-tombstone-q02","kind":"temporal"},{"text":"How may dispute, correction, rejection, withdrawal, supersession and tombstone be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"dispute-correction-rejection-withdrawal-supersession-and-tombstone-q03","kind":"retention"}]}]}]},{"id":"interoperability-access-quality-and-agent-governance","name":"Interoperability, access, quality and agent governance","description":"Provides versioned projections, quality controls, restricted views and safe automated maintenance.","layers":[{"id":"crosswalk-projection-deduplication-and-quality","name":"Crosswalk, projection, deduplication and quality","description":"Maps overlapping formats and measures claim-level quality.","findings":[{"id":"cve-nvd-osv-csaf-vex-stix-cwe-cvss-crosswalk-and-loss","name":"CVE, NVD, OSV, CSAF, VEX, STIX, CWE and CVSS crosswalk and loss","description":"Source and target versions, field mappings, code translations, omissions, assertion-authority changes and round-trip limits.","questions":[{"text":"What identifiers, source containers, classes, scope and values define cve, nvd, osv, csaf, vex, stix, cwe and cvss crosswalk and loss?","id":"cve-nvd-osv-csaf-vex-stix-cwe-cvss-crosswalk-and-loss-q01","kind":"definition"},{"text":"Which authority, evidence, method, event time and knowledge time support cve, nvd, osv, csaf, vex, stix, cwe and cvss crosswalk and loss?","id":"cve-nvd-osv-csaf-vex-stix-cwe-cvss-crosswalk-and-loss-q02","kind":"quality"},{"text":"How may cve, nvd, osv, csaf, vex, stix, cwe and cvss crosswalk and loss be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"cve-nvd-osv-csaf-vex-stix-cwe-cvss-crosswalk-and-loss-q03","kind":"security"}]},{"id":"completeness-consistency-timeliness-source-trust-and-conflict-quality","name":"Completeness, consistency, timeliness, source trust and conflict quality","description":"Quality rule version, evaluated claims, missing fields, stale sources, contradictions, validation evidence, score and prohibited inference.","questions":[{"text":"What identifiers, source containers, classes, scope and values define completeness, consistency, timeliness, source trust and conflict quality?","id":"completeness-consistency-timeliness-source-trust-and-conflict-quality-q01","kind":"classification"},{"text":"Which authority, evidence, method, event time and knowledge time support completeness, consistency, timeliness, source trust and conflict quality?","id":"completeness-consistency-timeliness-source-trust-and-conflict-quality-q02","kind":"process"},{"text":"How may completeness, consistency, timeliness, source trust and conflict quality be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"completeness-consistency-timeliness-source-trust-and-conflict-quality-q03","kind":"interoperability"}]}]},{"id":"access-retention-and-safe-agent-operations","name":"Access, retention and safe agent operations","description":"Controls disclosure and autonomous use.","findings":[{"id":"public-coordinator-vendor-researcher-operator-and-analytical-view","name":"Public, coordinator, vendor, researcher, operator and analytical view","description":"Audience, purpose, authority, allowed fields, embargo, contact masking, exploit-detail restriction, expiry, freshness and disclosure event.","questions":[{"text":"What identifiers, source containers, classes, scope and values define public, coordinator, vendor, researcher, operator and analytical view?","id":"public-coordinator-vendor-researcher-operator-and-analytical-view-q01","kind":"composition"},{"text":"Which authority, evidence, method, event time and knowledge time support public, coordinator, vendor, researcher, operator and analytical view?","id":"public-coordinator-vendor-researcher-operator-and-analytical-view-q02","kind":"measurement"},{"text":"How may public, coordinator, vendor, researcher, operator and analytical view be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"public-coordinator-vendor-researcher-operator-and-analytical-view-q03","kind":"validation"}]},{"id":"agent-authority-operation-prewrite-postwrite-concurrency-recovery-and-retention","name":"Agent authority, operation, pre-write, post-write, concurrency, recovery and retention","description":"Actor and agent, delegated authority, operation, expected head, validation, idempotency, approval class, outcome, rollback, retention and audit event.","questions":[{"text":"What identifiers, source containers, classes, scope and values define agent authority, operation, pre-write, post-write, concurrency, recovery and retention?","id":"agent-authority-operation-prewrite-postwrite-concurrency-recovery-and-retention-q01","kind":"state"},{"text":"Which authority, evidence, method, event time and knowledge time support agent authority, operation, pre-write, post-write, concurrency, recovery and retention?","id":"agent-authority-operation-prewrite-postwrite-concurrency-recovery-and-retention-q02","kind":"decision"},{"text":"How may agent authority, operation, pre-write, post-write, concurrency, recovery and retention be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation?","id":"agent-authority-operation-prewrite-postwrite-concurrency-recovery-and-retention-q03","kind":"temporal"}]}]}]}]},"agentConduct":{"may":["Correlate aliases across CVE, GHSA, OSV and vendor identifiers.","Match affected version ranges against an inventory and report candidates.","Attach an enrichment as a separate attributed assertion.","Produce a purpose-bound view for remediation teams."],"mustNot":["Overwrite a CNA or vendor assertion with its own enrichment.","Publish details of an embargoed vulnerability before coordinated disclosure.","Treat a CVSS base score as the local risk of a deployment.","Mark a product as unaffected without evidence.","Generate or distribute working exploit code."],"requiresHuman":["Disclosure timing and coordination with the affected vendor.","Rejecting, withdrawing or disputing a record.","Declaring a vulnerability not exploitable in a specific deployment."]},"ethics":{"considerations":["Premature disclosure puts users at risk before a fix exists, while delayed disclosure leaves them unaware.","Researchers deserve correct credit and protection from legal threats when they report in good faith.","Severity inflation or deflation shifts limited patching effort away from real risks."],"affectedParties":["Users and operators of affected products","Security researchers and reporters","Vendors and maintainers"]},"owners":{"steward":"Dimension identity, owner, vulnerability-record authority, namespace and accountable coordination roles","roles":[{"name":"Vulnerability record authority","responsibilities":["Own canonical identifier, record state and authorized source container."]},{"name":"CNA, vendor or ecosystem maintainer","responsibilities":["Publish attributable descriptions, affectedness and references within delegated scope."]},{"name":"Authorized data publisher or enrichment provider","responsibilities":["Add source-labelled metrics, mappings or threat signals without replacing master claims."]},{"name":"Researcher or reporter","responsibilities":["Provide reports and evidence under disclosure and credit policy."]},{"name":"Product and remediation owner","responsibilities":["Own product identity, fixes, advisories and remediation statements."]},{"name":"Asset and exposure owner","responsibilities":["Determine deployed applicability and operational response in external systems."]},{"name":"Disclosure, privacy and records steward","responsibilities":["Control embargoes, contact data, unsafe detail, access, retention and auditability."]}],"masterSystems":[]},"relations":[{"target":"Product, Package and Software Component models","type":"references","note":"Resolve affected subjects and version semantics without duplicating product identity."},{"target":"Weakness Classifier / CWE","type":"aligned","note":"Map vulnerability mechanisms to versioned weakness classes with method and confidence."},{"target":"Advisory, Fix, Remediation and Exposure models","type":"references","note":"Connect communications and operational response while preserving external master lifecycles."},{"target":"Exploit, Threat and Cyber Incident models","type":"references","note":"Link exploitation and realized security events without importing their evidence or response lifecycle."},{"target":"CVE, NVD, OSV, CSAF, VEX, STIX, CWE and CVSS","type":"aligned","note":"Project identity, affectedness, advisory, intelligence, classification and scoring data with declared loss."},{"target":"Weakness / CWE class","type":"neighbor","note":"A weakness class describes a recurring error pattern; a vulnerability record describes one source-qualified flaw or exposure instance that may map to one or more weakness classes."},{"target":"Product / Package / Component","type":"neighbor","note":"Product identity and version ordering remain external; this model owns source-qualified affectedness assertions about them."},{"target":"Deployed Asset Exposure","type":"neighbor","note":"Product-level affectedness does not prove that a specific deployed asset contains, reaches or exposes the vulnerable configuration."},{"target":"Security Advisory / Remediation","type":"neighbor","note":"An advisory can group vulnerabilities, products and remedies; fixes, workarounds and remediation execution retain separate identity and lifecycle."},{"target":"Exploit / Threat / Cyber Incident","type":"neighbor","note":"A vulnerability may enable exploitation and be referenced by threat or incident records, but exploit and incident evidence have independent identity, authority and lifecycle."}],"interaction":{"identity":{"applicability":"required","items":["Authoritative master-system vulnerability identifier qualified by issuing or home registry namespace.","Governed globally resolvable vulnerability IRI bound to the authoritative record.","Dimension UUID or ULID for a pre-publication local report when no external identifier exists."]},"properties":{"applicability":"not-applicable","items":[]},"recognition":{"applicability":"optional","items":["A vulnerability record has an identifier such as a CVE ID, a description, affected products and versions, and references.","It is confused with a weakness class (CWE), an advisory, an exploit or an incident."]},"capabilities":{"applicability":"required","items":["Register vulnerability record: Create authority-qualified identity, source container, initial description and explicit provisional state.","Classify weakness and describe mechanism: Attach source-qualified descriptions, CWE mappings, prerequisites and mechanism assertions.","Assert affected product range: Bind external product identity and a version or configuration status assertion.","Record discovery and coordination event: Append reporting, validation, vendor notification, embargo or disclosure events with protected attribution.","Attach severity assessment: Record a complete versioned CVSS vector or another source-qualified severity assertion.","Attach exploitation or priority signal: Record EPSS, KEV, SSVC or local-decision references with their distinct semantics and times.","Link remediation or exposure: Connect external fix, advisory, VEX product status, deployed exposure or remediation state.","Correct, reject, withdraw or supersede: Append a justified successor or terminal record state while retaining all cited history and aliases.","Issue purpose-bound vulnerability view: Create public, coordinator, vendor, operator or analytical projection with redaction and version pins.","Validate, reconcile and retire record: Evaluate schema, identifiers, relations, affectedness, sources and conflicts, then close or retain under policy."]},"hazards":{"applicability":"required","items":["Missed remediation when affected ranges are wrong or aliases are not linked.","Alert fatigue from duplicate or inflated records.","Exploitation after premature disclosure."]},"interfaces":{"applicability":"required","items":["CVE Record Format (JSON 5).","OSV schema.","CVSS v3.1 and v4.0.","CWE and CAPEC.","CSAF 2.0 and VEX.","Package URL (purl) and CPE 2.3."]},"context":{"applicability":"required","items":["CVE and NVD are globally used but their program and U.S. enrichment governance are not universal product truth.","CISA KEV operational deadlines apply to defined U.S. federal scope, although the catalog can inform other organizations.","Vendor, CNA, ecosystem and national disclosure practices differ and require local policy profiles."]}},"sources":[{"title":"CVE Record Format","url":"https://cveproject.github.io/cve-schema/","note":"CVE Program"},{"title":"CVE JSON record format documentation","url":"https://cveproject.github.io/cve-schema/schema/docs/","note":"CVE Program"},{"title":"NVD Data Feeds and JSON 2.0 schemas","url":"https://nvd.nist.gov/vuln/data-feeds","note":"National Institute of Standards and Technology"},{"title":"CWE Downloads and published schemas","url":"https://cwe.mitre.org/data/downloads.html","note":"MITRE"},{"title":"Common Vulnerability Scoring System version 4.0 Specification","url":"https://www.first.org/cvss/v4.0/specification-document","note":"Forum of Incident Response and Security Teams"},{"title":"Exploit Prediction Scoring System","url":"https://www.first.org/epss/","note":"Forum of Incident Response and Security Teams"},{"title":"Known Exploited Vulnerabilities Catalog","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","note":"Cybersecurity and Infrastructure Security Agency"},{"title":"Common Security Advisory Framework Version 2.0 Errata 01","url":"https://docs.oasis-open.org/csaf/csaf/v2.0/errata01/os/csaf-v2.0-errata01-os.html","note":"OASIS"},{"title":"Open Source Vulnerability format","url":"https://ossf.github.io/osv-schema/","note":"Open Source Security Foundation"},{"title":"STIX Version 2.1","url":"https://docs.oasis-open.org/cti/stix/v2.1/os/stix-v2.1-os.html","note":"OASIS"},{"title":"PROV-O: The PROV Ontology","url":"https://www.w3.org/TR/prov-o/","note":"World Wide Web Consortium"},{"title":"Date and Time on the Internet: Timestamps","url":"https://www.rfc-editor.org/rfc/rfc3339","note":"Internet Engineering Task Force"}],"openQuestions":["Approve relation cardinalities and ownership contracts for products, weaknesses, advisories, exposures, remediation, exploits, threats and incidents.","Develop ecosystem and product profiles for affected-version ordering, forks, backports, configurations and end-of-life branches.","Create fixtures for duplicate, split, merge, rejection, withdrawal, conflicting ranges, multiple CVSS sources, KEV addition and VEX status changes.","Validate certified cross-schema projections with authority, time, conflict, access, information-loss and round-trip tests.","No independent Claude or Grok result was available; later vulnerability-management review is required before canonical promotion.","No approved outgoing relation rows were supplied; product, weakness, advisory, exposure, remediation, exploit, threat and incident contracts remain reviewable draft references.","Vendor, ecosystem, embedded, cloud, hardware, configuration and end-of-life product profiles require specialist review.","Certified CVE, NVD, OSV, CSAF, VEX, STIX, CWE and CVSS crosswalk fixtures remain future work."],"resources":{"spec":"/models/wm-sft-006-vulnerability-record/spec.yaml","agents":"/models/wm-sft-006-vulnerability-record/AGENTS.md","source":"https://github.com/ver-cy/world-models/tree/feat/mega-model-registry/research/runs/wm-sft-006"},"provenance":{"origin":"world-models research","builtFrom":["models/wm-sft-006-vulnerability-record/spec.yaml","ver-cy/world-models/card-supplements/wm-sft-006-vulnerability-record.json"],"providers":["Codex"],"researchStatus":"reviewable-draft","generatedAt":"2026-09-06T03:50:09Z","builder":"tools/build_cards.py@1.0.0"},"completeness":{"sections":{"classifiers":"filled","whatItIs":"filled","purpose":"filled","distinguishingFeatures":"filled","structure":"filled","agentConduct":"filled","ethics":"filled","owners":"filled","relations":"filled","interaction.identity":"filled","interaction.properties":"not-applicable","interaction.recognition":"filled","interaction.capabilities":"filled","interaction.hazards":"filled","interaction.interfaces":"filled","interaction.context":"filled","sources":"filled"},"notes":{"interaction.properties":"Institutional or informational subject: no invented physical properties.","_supplement":"Sections authored in card supplement 1.0.0 by Claude (Opus 5.5) (2026-10-05, unreviewed). Written from the published specification and established practice in the field; no new sources were read. Unreviewed."},"score":1.0}}