In the late 1990s, security practitioners struggled with a fundamental problem: the same vulnerability often appeared under completely different names in every tool and advisory. One NFS issue, for example, was listed as NFS file guessing check in CyberCop, nfs-guess in X-Force, and SunOS NFS Jumbo and fsirand patches in CERT bulletins. The PHF CGI vulnerability alone carried roughly a dozen separate names across vendors.
Inside MITRE, the Information Security Committee faced the same pain when correlating output from multiple scanners and IDS products. On 8 January 1999, engineers David E. Mann and Steven M. Christey published the paper “Towards a Common Enumeration of Vulnerabilities,” proposing a deliberately minimal solution: a single public list containing only a unique identifier and a short description.
Why a simple list, not a taxonomy
The authors rejected attempts to build a universal classification system. They argued that even basic questions, such as how to describe an operating system, quickly led to endless debates. Instead, CVE would serve as a neutral bridge: every vendor could keep its own categories and risk models while mapping records to the shared CVE identifier.
The naming format was intentionally plain—CVE-year-number—to avoid new arguments over naming conventions. The first public version, released after nine months of work, contained 321 entries and was supported by an Editorial Board of 19 organizations.
Openness and community governance
MITRE insisted that CVE remain public, freely redistributable, and free of vendor copyright restrictions. This decision removed commercial barriers and positioned the organization as a moderator rather than an owner of truth. The model was first presented at the 2nd Workshop on Research with Security Vulnerability Databases at Purdue University in January 1999, attended by roughly 100 participants from NIST, NSA, IBM, Cisco, and academic groups.
The resulting infrastructure became the foundation for later projects including NVD, OSV, and GitHub Advisory Database. The original 1999 design choices—minimalism, openness, and community ownership—continue to define how the industry refers to vulnerabilities today.
