About GCVE

The Global CVE (GCVE) initiative is an open, decentralised approach to vulnerability identification, publication, and exchange. It gives participating organisations autonomy over identifier allocation and disclosure while retaining a simple mapping for existing CVE identifiers.

GCVE is operated by CIRCL — Computer Incident Response Center Luxembourg and developed in the open with vulnerability coordinators, vendors, researchers, tool developers, and data consumers. CIRCL also maintains Vulnerability-Lookup, the open-source platform that powers GCVE services and provides a reference implementation of several GCVE practices.

How GCVE works

A GCVE Numbering Authority (GNA) is an autonomous participant authorised to allocate GCVE identifiers. Each GNA receives a unique numeric namespace and can define its own vulnerability-identification and disclosure policy without requesting identifier blocks from a central allocation authority.

The identifier starts with the authority’s namespace:

GCVE-<GNA-ID>-<GNA-VALUE>

A commonly used form is GCVE-<GNA-ID>-<YEAR>-<UNIQUE-ID>. For example, GCVE-1-2025-00001 belongs to GNA 1. Existing CVE identifiers map directly into the reserved GNA 0 namespace: CVE-2023-40224 becomes GCVE-0-2023-40224.

This model provides:

• Autonomy: GNAs allocate and publish identifiers at their own pace and under their own policies.
• Interoperability: shared formats and discovery mechanisms allow independently operated systems to exchange data.
• Scalability: allocation does not depend on a central block-distribution workflow.
• Compatibility: existing CVE identifiers retain an unambiguous representation through GNA 0.
• Provenance: the GNA namespace makes the source of an identifier explicit.

Detailed allocation recommendations are available in GCVE-BCP-04. The current authorities, their public endpoints, and their individual profiles are maintained in the GNA directory, where the complete directory can also be downloaded as JSON.

From identifiers to an operational ecosystem

GCVE has grown beyond identifier allocation into a set of open practices, software, data, and public services. These components are designed to work together while remaining independently reusable.

Best Current Practices

The GCVE Best Current Practice catalogue documents the community’s shared approaches to:

• directory signing and verification;
• vulnerability handling and disclosure;
• decentralised publication and identifier allocation;
• the GCVE vulnerability record format;
• GNA requirements and evaluation;
• Known Exploited Vulnerability (KEV) assertions;
• record scope, improved product enumeration, and vulnerability sightings;
• transparent provenance for AI-assisted annotations and patch-derived vulnerability information.

Each document is clearly marked as published, under public review, or in draft. BCPs are living, community-developed guidance rather than a centrally imposed policy. The open BCP development process explains how proposals are discussed and improved.

Public services

Both services are backed by open-source software. See the software catalogue for Vulnerability-Lookup, the CPE editor, GCVE utilities, schemas, and related projects, or browse GCVE open data for machine-readable dumps and enriched data sets.

Participate as a GNA

Existing CVE Numbering Authorities, recognised CSIRTs and CERTs, and organisations that regularly publish vulnerability information may be eligible for a GNA ID. Applicants should maintain a public disclosure policy or publication source and be prepared to provide the relevant organisation and machine-readable endpoint metadata.

The complete eligibility criteria, requested metadata, and application steps are on Publishing Vulnerability Information. GNA requests can be sent to gna@gcve.eu.

Community, governance, and citation

GCVE develops its practices transparently and welcomes review, implementation feedback, and contributions. Learn about the people and governance around the initiative on the community page, join the discussion on the GCVE forum, or contact the project.

For the history and relationship between GCVE, Vulnerability-Lookup, and other vulnerability databases, see the FAQ. If you reference the initiative in academic, technical, or operational work, please use the recommended entry on the citation page.