Does CVE have a procedure for determining how to assign candidate numbers to newly discovered vulnerabilities?
Yes. CVE editorial policies, or “content decisions” (CDs), are the criteria and consistency rules that determine (1) what security issues become CVE candidates for eventual inclusion in the CVE List, and (2) how we distinguish between similar or security related issues. Generally, the CVE approach is to create separate candidates for: • Vulnerabilities of different types • Vulnerabilities of the same type that appear in different versions • Vulnerabilities that appear in different codebases (i.e., “by vendor;” however, this also includes vendors who share the same code such as Linux/Unix vendors) See CVE Editorial Policies for a detailed description and examples of this process.
