2026-06-02 07:54 UTC
@gcve@social.circl.lu I am not sure I get it.
(CPEs suck big time and I hate them with a deep passion, but PURLs have a much more limited scope, so I have to live with CPEs for the foreseeable future. This being said...)
...The main problem I see with CPE are not "CPE out of thin air", or "in some dictionary", just for the pleasure of listing CPE. The pb is G/CVE
1/ without any CPE,
2/ or without useful CPE,
3/ or with an incorrect CPE.
This is what I have to deal with daily. I don't understand how this CPE editor is helping in this regard. Is there some link to vulns that I'd de missing?
Replies (1)
-
@gcve@social.circl.lu 2026-06-07 07:31
@jbm@infosec.exchange CPE exists and we have to deal with it. What we try to do is the following: - Providing a way for any contributors to link mistyped vendor/products, product renamed along with metadata. - The CPE there includes all the different sources known for CPE including NIST, CVE Program cvelist_v5 or CPE2PURL. Each of the dataset was covering only a part of the full CPE coverage. It mainly helps to find vulnerability scattered across vendor or product names. https://gcve.eu/2026/06/02/introducing-cpe.gcve.eu-a-collaborative-catalog-for-vendors-products-cpes-and-purls/