Repository navigation
Patch release of the 7.0 line. CVE records sourced from NVD now carry the CNA's real identity instead of a truncated UUID or a contact email.
NVD API 2.0 fills sourceIdentifier with either a contact email or the CNA org UUID. A UUID used to be stored cut to 31 characters as assignerShortName, with assignerOrgId derived from a hash of it, so CVE-2026-87018 (pkg:npm/undici) named its source "ce714d77-add3-4f53-aff5-83d477b" where the published record says "openjs" (#303). UUID assigners are now kept verbatim as the org id and paired with the CNA short name, and contact emails that name a known org store that org's registry short name: "cve@mitre.org" stores "mitre" and "security-advisories@github.com" stores "github_m". The two org id fields of a record can no longer disagree.
To back this, ASSIGNER_UUID_MAP grows from 325 to 774 entries, regenerated from cvelistV5 and from joining an NVD API 2.0 mirror against it by CVE id; contrib/generate_assigner_map.py regenerates and audits the map. On that snapshot every UUID sourceIdentifier, 25,897 records, resolves to a short name against 20,561 before, and email coverage rises from 117,145 to 390,700 records. Renamed CNAs such as opentext and ly-corporation resolve to their current name. Databases built from this code are slightly smaller (about 0.6% on an NVD-only build) and classify 117,477 records under nvd or osv that previously read unknown, which affects source filters such as the MCP server. Existing databases keep working; the new values appear on the next database build.
mcp-server-vdb 7.0.4 is published alongside this release and pins this version.
Full Changelog: v7.0.3...v7.0.4
Thanks
Reported the bugs fixed here:
- August Johansson: #303