@jbm@infosec.exchange CPE exists and we have to deal with it. What we try to do is the following: - Providing a way for any contributors to link mistyped vendor/products, product renamed along with metadata. - The CPE there includes all the different sources known for CPE including NIST, CVE Program cvelist_v5 or CPE2PURL. Each of the dataset was covering only a part of the full CPE coverage. It mainly helps to find vulnerability scattered across vendor or product names. https://gcve.eu/2026/06/02/introducing-cpe.gcve.eu-a-collaborative-catalog-for-vendors-products-cpes-and-purls/