Published

Vulnerability Record

vr.wm-sft-006 · wm-sft-006-vulnerability-record

Represent an authority-qualified security vulnerability record, its affected product assertions, evidence, assessments and disclosure lifecycle independent of storage and interface format.

World Models Information and virtual systems INF.SFT.VUL

Bundle → Layer → Finding → Questions Classifiers What it is Why it exists Distinguishing features What robots and AI may and may not do Moral aspects Owners Links to other meta-models Identity and identifiers Direct properties Recognition Capabilities and actions Hazards and failure modes Standards and interfaces Context of use Sources

Bundle → Layer → Finding → Questions Filled

6 bundles · 12 layers · 24 findings · 72 questions

Vulnerability identity, record authority and class Identifies one vulnerability record and preserves source authority, aliases and assertion containers.

Record identity, aliases and boundary

Stable identifiers and relations among same, upstream and related vulnerability records.

Authoritative identifier, namespace, alias, resolver and collision

Master identifier, assigning namespace, aliases, resolver, reservation status, predecessor, duplicate and collision evidence.

What identifiers, source containers, classes, scope and values define authoritative identifier, namespace, alias, resolver and collision? identity
Which authority, evidence, method, event time and knowledge time support authoritative identifier, namespace, alias, resolver and collision? evidence
How may authoritative identifier, namespace, alias, resolver and collision be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? validation

Same vulnerability, upstream, related, split and merge boundary

Source-qualified relation kind, direction, matching criteria, affected-component scope, split or merge rationale and uncertainty.

What identifiers, source containers, classes, scope and values define same vulnerability, upstream, related, split and merge boundary? relationship
Which authority, evidence, method, event time and knowledge time support same vulnerability, upstream, related, split and merge boundary? authority
How may same vulnerability, upstream, related, split and merge boundary be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? exception

Record container, authorship and version

Separates authoritative source containers and immutable versions.

CNA, ADP, NVD, vendor, ecosystem and database assertion container

Container kind, source organization, role, authority, schema version, covered claims, original locator and signature or digest.

What identifiers, source containers, classes, scope and values define cna, adp, nvd, vendor, ecosystem and database assertion container? ownership
Which authority, evidence, method, event time and knowledge time support cna, adp, nvd, vendor, ecosystem and database assertion container? provenance
How may cna, adp, nvd, vendor, ecosystem and database assertion container be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? access

Record version, state, published, modified, rejected and withdrawn

Version identifier, lifecycle state, state reason, predecessor, publication and modification times, withdrawal or rejection and retained history.

What identifiers, source containers, classes, scope and values define record version, state, published, modified, rejected and withdrawn? lifecycle
Which authority, evidence, method, event time and knowledge time support record version, state, published, modified, rejected and withdrawn? temporal
How may record version, state, published, modified, rejected and withdrawn be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? retention

Description, weakness and affected product Describes the flaw and source-qualified affected product and version assertions.

Descriptions, problem types and root cause

Captures multilingual statements and classifier mappings without turning inference into fact.

Summary, description, language, supporting media and redaction

Plain-language and technical descriptions, language, media type, value, redaction markers, source, audience and version.

What identifiers, source containers, classes, scope and values define summary, description, language, supporting media and redaction? definition
Which authority, evidence, method, event time and knowledge time support summary, description, language, supporting media and redaction? quality
How may summary, description, language, supporting media and redaction be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? security

CWE problem type, root cause, mechanism and prerequisite

Versioned CWE or other classifier reference, mapping method, weakness mechanism, prerequisites, confidence and disputed mappings.

What identifiers, source containers, classes, scope and values define cwe problem type, root cause, mechanism and prerequisite? classification
Which authority, evidence, method, event time and knowledge time support cwe problem type, root cause, mechanism and prerequisite? process
How may cwe problem type, root cause, mechanism and prerequisite be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? interoperability

Products, platforms, versions and status

Expresses affectedness independently of inventory exposure.

Vendor, product, package, module, platform, CPE, purl and identity reference

External product or package identity, vendor, module, platform, CPE or purl, ecosystem and source namespace.

What identifiers, source containers, classes, scope and values define vendor, product, package, module, platform, cpe, purl and identity reference? composition
Which authority, evidence, method, event time and knowledge time support vendor, product, package, module, platform, cpe, purl and identity reference? measurement
How may vendor, product, package, module, platform, cpe, purl and identity reference be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? validation

Affected, unaffected, unknown version range, configuration and justification

Product-status assertion, range scheme, introduced, fixed, last affected or limit events, configuration constraints, justification and source confidence.

What identifiers, source containers, classes, scope and values define affected, unaffected, unknown version range, configuration and justification? state
Which authority, evidence, method, event time and knowledge time support affected, unaffected, unknown version range, configuration and justification? decision
How may affected, unaffected, unknown version range, configuration and justification be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? temporal

Discovery, disclosure, evidence and coordination Records accountable discovery and disclosure evidence without publishing restricted exploit detail.

Discovery, reporting, evidence and confidence

Separates reports and observations from validated vulnerability claims.

Discoverer, reporter, contact role, credit and attribution

External actor reference, contribution role, requested credit, contact protection, organization, consent and attribution status.

What identifiers, source containers, classes, scope and values define discoverer, reporter, contact role, credit and attribution? identity
Which authority, evidence, method, event time and knowledge time support discoverer, reporter, contact role, credit and attribution? evidence
How may discoverer, reporter, contact role, credit and attribution be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? validation

Discovery method, report, evidence, reproducer, validation and confidence

Method, report reference, restricted evidence locator, affected environment, validation outcome, validator, confidence and disclosure class.

What identifiers, source containers, classes, scope and values define discovery method, report, evidence, reproducer, validation and confidence? relationship
Which authority, evidence, method, event time and knowledge time support discovery method, report, evidence, reproducer, validation and confidence? authority
How may discovery method, report, evidence, reproducer, validation and confidence be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? exception

Coordination, timeline, references and disclosure

Maintains event and publication history and typed evidence links.

Reservation, vendor notification, embargo, publication, update and knowledge time

Event kind, actor, event time, observation and knowledge time, embargo authority, planned disclosure, actual publication and sequence.

What identifiers, source containers, classes, scope and values define reservation, vendor notification, embargo, publication, update and knowledge time? ownership
Which authority, evidence, method, event time and knowledge time support reservation, vendor notification, embargo, publication, update and knowledge time? provenance
How may reservation, vendor notification, embargo, publication, update and knowledge time be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? access

Advisory, report, fix, evidence reference, tag and integrity

Typed URL or document reference, source, role, tags, access class, retrieved version, digest, publication state and trust caveat.

What identifiers, source containers, classes, scope and values define advisory, report, fix, evidence reference, tag and integrity? lifecycle
Which authority, evidence, method, event time and knowledge time support advisory, report, fix, evidence reference, tag and integrity? temporal
How may advisory, report, fix, evidence reference, tag and integrity be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? retention

Severity, exploitability and prioritization signals Stores versioned assessments while preventing severity, exploitation probability, known exploitation and organizational risk from being conflated.

CVSS severity and impact assertions

Preserves vector, metric group, scope and assessor.

CVSS version, vector, Base, Threat, Environmental and Supplemental metrics

CVSS version, full vector, metric groups, score, qualitative rating, calculator version and calculation evidence.

What identifiers, source containers, classes, scope and values define cvss version, vector, base, threat, environmental and supplemental metrics? definition
Which authority, evidence, method, event time and knowledge time support cvss version, vector, base, threat, environmental and supplemental metrics? quality
How may cvss version, vector, base, threat, environmental and supplemental metrics be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? security

Severity assessor, scope, product context, time and disagreement

Assessor identity and role, affected product scope, environment, assertion time, source container, confidence and relation to competing scores.

What identifiers, source containers, classes, scope and values define severity assessor, scope, product context, time and disagreement? classification
Which authority, evidence, method, event time and knowledge time support severity assessor, scope, product context, time and disagreement? process
How may severity assessor, scope, product context, time and disagreement be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? interoperability

Exploitation, priority and risk context

Links time-varying signals and local decisions without inventing one universal priority.

EPSS probability, percentile, model date, window and source

Estimated probability, percentile, scoring date, prediction window, model version, source and later-observed outcome reference.

What identifiers, source containers, classes, scope and values define epss probability, percentile, model date, window and source? composition
Which authority, evidence, method, event time and knowledge time support epss probability, percentile, model date, window and source? measurement
How may epss probability, percentile, model date, window and source be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? validation

KEV known exploitation, SSVC decision, priority and local risk reference

Catalog or decision source, inclusion evidence, known-ransomware status, decision points, required action, due date and external local-risk decision.

What identifiers, source containers, classes, scope and values define kev known exploitation, ssvc decision, priority and local risk reference? state
Which authority, evidence, method, event time and knowledge time support kev known exploitation, ssvc decision, priority and local risk reference? decision
How may kev known exploitation, ssvc decision, priority and local risk reference be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? temporal

Remediation, exposure and change lifecycle Links remediation and concrete exposure processes while preserving vulnerability record history.

Remediation, advisory, fix and exposure links

Connects external products, advisories, fixes and deployments.

Fix version, patch, commit, workaround, mitigation and remediation reference

External remediation identifier, kind, vendor, product scope, fixed version or commit, availability, restart, caveat and supersession.

What identifiers, source containers, classes, scope and values define fix version, patch, commit, workaround, mitigation and remediation reference? identity
Which authority, evidence, method, event time and knowledge time support fix version, patch, commit, workaround, mitigation and remediation reference? evidence
How may fix version, patch, commit, workaround, mitigation and remediation reference be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? validation

Deployed asset exposure, detection, VEX status and verification reference

External asset and exposure identifiers, matched product evidence, VEX product status, detection time, verification method and current remediation-state reference.

What identifiers, source containers, classes, scope and values define deployed asset exposure, detection, vex status and verification reference? relationship
Which authority, evidence, method, event time and knowledge time support deployed asset exposure, detection, vex status and verification reference? authority
How may deployed asset exposure, detection, vex status and verification reference be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? exception

Record change, dispute, correction and retirement

Keeps append-only changes and justified terminal states.

Change item, field diff, reason, source, actor and predecessor

Changed path, old and new assertion references, reason, responsible actor, authority, predecessor digest, validation and effective time.

What identifiers, source containers, classes, scope and values define change item, field diff, reason, source, actor and predecessor? ownership
Which authority, evidence, method, event time and knowledge time support change item, field diff, reason, source, actor and predecessor? provenance
How may change item, field diff, reason, source, actor and predecessor be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? access

Dispute, correction, rejection, withdrawal, supersession and tombstone

Challenge and evidence, resolution authority, corrected successor, rejection or withdrawal reason, tombstone status and retained aliases.

What identifiers, source containers, classes, scope and values define dispute, correction, rejection, withdrawal, supersession and tombstone? lifecycle
Which authority, evidence, method, event time and knowledge time support dispute, correction, rejection, withdrawal, supersession and tombstone? temporal
How may dispute, correction, rejection, withdrawal, supersession and tombstone be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? retention

Interoperability, access, quality and agent governance Provides versioned projections, quality controls, restricted views and safe automated maintenance.

Crosswalk, projection, deduplication and quality

Maps overlapping formats and measures claim-level quality.

CVE, NVD, OSV, CSAF, VEX, STIX, CWE and CVSS crosswalk and loss

Source and target versions, field mappings, code translations, omissions, assertion-authority changes and round-trip limits.

What identifiers, source containers, classes, scope and values define cve, nvd, osv, csaf, vex, stix, cwe and cvss crosswalk and loss? definition
Which authority, evidence, method, event time and knowledge time support cve, nvd, osv, csaf, vex, stix, cwe and cvss crosswalk and loss? quality
How may cve, nvd, osv, csaf, vex, stix, cwe and cvss crosswalk and loss be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? security

Completeness, consistency, timeliness, source trust and conflict quality

Quality rule version, evaluated claims, missing fields, stale sources, contradictions, validation evidence, score and prohibited inference.

What identifiers, source containers, classes, scope and values define completeness, consistency, timeliness, source trust and conflict quality? classification
Which authority, evidence, method, event time and knowledge time support completeness, consistency, timeliness, source trust and conflict quality? process
How may completeness, consistency, timeliness, source trust and conflict quality be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? interoperability

Access, retention and safe agent operations

Controls disclosure and autonomous use.

Public, coordinator, vendor, researcher, operator and analytical view

Audience, purpose, authority, allowed fields, embargo, contact masking, exploit-detail restriction, expiry, freshness and disclosure event.

What identifiers, source containers, classes, scope and values define public, coordinator, vendor, researcher, operator and analytical view? composition
Which authority, evidence, method, event time and knowledge time support public, coordinator, vendor, researcher, operator and analytical view? measurement
How may public, coordinator, vendor, researcher, operator and analytical view be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? validation

Agent authority, operation, pre-write, post-write, concurrency, recovery and retention

Actor and agent, delegated authority, operation, expected head, validation, idempotency, approval class, outcome, rollback, retention and audit event.

What identifiers, source containers, classes, scope and values define agent authority, operation, pre-write, post-write, concurrency, recovery and retention? state
Which authority, evidence, method, event time and knowledge time support agent authority, operation, pre-write, post-write, concurrency, recovery and retention? decision
How may agent authority, operation, pre-write, post-write, concurrency, recovery and retention be validated, disputed, corrected, superseded, retained and disclosed without enabling unsafe exploitation? temporal

Classifiers Filled

Family: World Models
Category: Information and virtual systems
Entry kind: aggregate
Navigation path: NAV.INF.SFT.VUL
Domain: INF.SFT.VUL
Industry: Cross-industry
Tags: vulnerabilityrecordinf.sft.vul
Also called: S8

What it is Filled

Owns vulnerability record identity and aliases, source assertion containers, descriptions, weakness mappings, affected product and version assertions, discovery and disclosure evidence, credits, references, severity and exploitation assessments, lifecycle changes, quality, access and provenance. Product, package, deployed asset, advisory, patch, remediation task, exploit, threat, risk decision and incident masters remain external.

In scope

Authoritative identity, aliases, source containers, descriptions, problem types, affected products, platforms, versions and configurations
Discovery, reporter and validation evidence, coordination timeline, references, credits, CVSS and time-varying exploitation or prioritization signals
Remediation and exposure links, corrections, rejection, withdrawal, supersession, interoperability, quality, access, retention and safe operations

Out of scope

Product, package, software component, deployed asset, advisory, patch, fix, remediation task or inventory master lifecycle
Exploit, threat actor, campaign, indicator, cyber incident, control, organizational risk or risk-acceptance master lifecycle
Exploit generation, unauthorized scanning, universal risk scoring, automated disclosure decisions or guaranteed cross-schema equivalence

Why it exists Filled

Represent an authority-qualified security vulnerability record, its affected product assertions, evidence, assessments and disclosure lifecycle independent of storage and interface format.

Distinguishing features Filled

Models a published vulnerability with its source assertions, not the weakness class it instances.
Keeps CNA, vendor and enrichment claims in separate containers rather than one merged truth.
Separates the vulnerability from exposure on deployed assets, advisories and exploits.
Holds severity and exploitation signals with source, method and scoring time.

What robots and AI may and may not do Filled

Must not

Overwrite a CNA or vendor assertion with its own enrichment.
Publish details of an embargoed vulnerability before coordinated disclosure.
Treat a CVSS base score as the local risk of a deployment.
Mark a product as unaffected without evidence.
Generate or distribute working exploit code.

Only with a human decision

Disclosure timing and coordination with the affected vendor.
Rejecting, withdrawing or disputing a record.
Declaring a vulnerability not exploitable in a specific deployment.

May

Correlate aliases across CVE, GHSA, OSV and vendor identifiers.
Match affected version ranges against an inventory and report candidates.
Attach an enrichment as a separate attributed assertion.
Produce a purpose-bound view for remediation teams.

Moral aspects Filled

Premature disclosure puts users at risk before a fix exists, while delayed disclosure leaves them unaware.
Researchers deserve correct credit and protection from legal threats when they report in good faith.
Severity inflation or deflation shifts limited patching effort away from real risks.

Who is affected

Users and operators of affected products
Security researchers and reporters
Vendors and maintainers

Owners Filled

Steward

Dimension identity, owner, vulnerability-record authority, namespace and accountable coordination roles

Roles

Vulnerability record authority: Own canonical identifier, record state and authorized source container.
CNA, vendor or ecosystem maintainer: Publish attributable descriptions, affectedness and references within delegated scope.
Authorized data publisher or enrichment provider: Add source-labelled metrics, mappings or threat signals without replacing master claims.
Researcher or reporter: Provide reports and evidence under disclosure and credit policy.
Product and remediation owner: Own product identity, fixes, advisories and remediation statements.
Asset and exposure owner: Determine deployed applicability and operational response in external systems.
Disclosure, privacy and records steward: Control embargoes, contact data, unsafe detail, access, retention and auditability.

Links to other meta-models Filled

references

Product, Package and Software Component models - Resolve affected subjects and version semantics without duplicating product identity.
Advisory, Fix, Remediation and Exposure models - Connect communications and operational response while preserving external master lifecycles.
Exploit, Threat and Cyber Incident models - Link exploitation and realized security events without importing their evidence or response lifecycle.

aligned

Weakness Classifier / CWE - Map vulnerability mechanisms to versioned weakness classes with method and confidence.
CVE, NVD, OSV, CSAF, VEX, STIX, CWE and CVSS - Project identity, affectedness, advisory, intelligence, classification and scoring data with declared loss.

neighbor

Weakness / CWE class - A weakness class describes a recurring error pattern; a vulnerability record describes one source-qualified flaw or exposure instance that may map to one or more weakness classes.
Product / Package / Component - Product identity and version ordering remain external; this model owns source-qualified affectedness assertions about them.
Deployed Asset Exposure - Product-level affectedness does not prove that a specific deployed asset contains, reaches or exposes the vulnerable configuration.
Security Advisory / Remediation - An advisory can group vulnerabilities, products and remedies; fixes, workarounds and remediation execution retain separate identity and lifecycle.
Exploit / Threat / Cyber Incident - A vulnerability may enable exploitation and be referenced by threat or incident records, but exploit and incident evidence have independent identity, authority and lifecycle.

What else AI and robots need to interact with it Filled

Sources Filled

CVE Record Format - CVE Program
CVE JSON record format documentation - CVE Program
NVD Data Feeds and JSON 2.0 schemas - National Institute of Standards and Technology
CWE Downloads and published schemas - MITRE
Common Vulnerability Scoring System version 4.0 Specification - Forum of Incident Response and Security Teams
Exploit Prediction Scoring System - Forum of Incident Response and Security Teams
Known Exploited Vulnerabilities Catalog - Cybersecurity and Infrastructure Security Agency
Common Security Advisory Framework Version 2.0 Errata 01 - OASIS
Open Source Vulnerability format - Open Source Security Foundation
STIX Version 2.1 - OASIS
PROV-O: The PROV Ontology - World Wide Web Consortium
Date and Time on the Internet: Timestamps - Internet Engineering Task Force

Open questions

Approve relation cardinalities and ownership contracts for products, weaknesses, advisories, exposures, remediation, exploits, threats and incidents.
Develop ecosystem and product profiles for affected-version ordering, forks, backports, configurations and end-of-life branches.
Create fixtures for duplicate, split, merge, rejection, withdrawal, conflicting ranges, multiple CVSS sources, KEV addition and VEX status changes.
Validate certified cross-schema projections with authority, time, conflict, access, information-loss and round-trip tests.
No independent Claude or Grok result was available; later vulnerability-management review is required before canonical promotion.
No approved outgoing relation rows were supplied; product, weakness, advisory, exposure, remediation, exploit, threat and incident contracts remain reviewable draft references.
Vendor, ecosystem, embedded, cloud, hardware, configuration and end-of-life product profiles require specialist review.
Certified CVE, NVD, OSV, CSAF, VEX, STIX, CWE and CVSS crosswalk fixtures remain future work.

Machine files

Card as JSON Specification AGENTS.md Source Card backlog vercy.card/1

Provenance

world-models research · reviewable-draft

Built from: models/wm-sft-006-vulnerability-record/spec.yaml, ver-cy/world-models/card-supplements/wm-sft-006-vulnerability-record.json