Proposal: Add MITRE CVE List V5 as an Advisory Data Source

Bắt đầu bằng việc xem xét repository CVEProject/cvelistV5 và các nguồn advisory đã được liệt kê trong issue này để hiểu các bản ghi hiện có và các phương pháp ingestion. Công việc được xem là hoàn tất khi đã xác định chiến lược về tính khả thi và mapping để thêm MITRE CVE List V5 vào pipeline của GitHub Advisory Database.

Hello GitHub Advisory Database Team,

First, thank you for maintaining and continuously improving the GitHub Advisory Database. It has become an invaluable resource for the open-source ecosystem.

I would like to propose adding the MITRE CVE List V5 repository as an additional advisory source:

https://github.com/CVEProject/cvelistV5

Currently, the GitHub Advisory Database ingests advisories from sources such as:

• Security advisories reported on GitHub
• National Vulnerability Database (NVD)
• npm Security Advisories Database
• FriendsOfPHP Database
• Go Vulnerability Database
• Python Packaging Advisory Database
• Ruby Advisory Database
• RustSec Advisory Database
• Community contributions

The MITRE CVE List V5 repository contains the authoritative CNA-submitted CVE records and often includes rich product metadata before or independent of downstream enrichment. Many records already contain ecosystem-specific package information that could potentially be mapped directly into GitHub Advisory Database package ecosystems.

For example, Apache-related CVEs frequently include package references that align with Maven coordinates, making them suitable candidates for automated package matching and advisory enrichment.

Potential benefits include:

• Faster availability of newly published CVEs.
• Access to authoritative CNA-provided metadata.
• Improved package ecosystem coverage.
• Additional package mappings that may not yet be present in other advisory feeds.
• Better support for dependency and supply-chain vulnerability detection.

I would be interested in helping evaluate feasibility, mapping strategies, and implementation approaches for integrating CVE List V5 data into the GitHub Advisory Database pipeline.

Thank you for considering this suggestion.