[
  {
    "id": "glossaryCoR",
    "term": "Council of Roots",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryCoR",
    "definition": "The group of TL-Roots and Roots responsible for governance and administration of their respective hierarchies."
  },
  {
    "id": "glossaryCVE",
    "term": "CVE",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryCVE",
    "definition": "The CVE trademark and the name Common Vulnerabilities and Exposures."
  },
  {
    "id": "glossaryBoard",
    "term": "CVE Board",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryBoard",
    "definition": "The organization responsible for the strategic direction, governance, operational structure, policies, and rules of the CVE Program."
  },
  {
    "id": "glossaryCVEID",
    "term": "CVE Identifier (CVE ID)",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryCVEID",
    "definition": "An alphanumeric string that identifies a Publicly Disclosed vulnerability. The format of the CVE ID is defined in the CVE Record Format."
  },
  {
    "id": "glossaryCVEList",
    "term": "CVE List",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryCVEList",
    "definition": "The catalog of all published CVE Records."
  },
  {
    "id": "glossaryCNA",
    "term": "CVE Numbering Authority (CNA)",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryCNA",
    "definition": "An authorized entity with specific scope and responsibility to regularly assign CVE IDs and publish corresponding CVE Records."
  },
  {
    "id": "glossaryCNALR",
    "term": "CVE Numbering Authority of Last Resort (CNA-LR)",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryCNALR",
    "definition": "A CNA authorized by a Root to assign CVE IDs and to publish corresponding CVE Records within that Root’s scope for vulnerabilities not covered by the Scope of another CNA."
  },
  {
    "id": "glossaryProgram",
    "term": "CVE Program",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryProgram",
    "definition": "An international, community-driven effort to identify and catalog publicly disclosed vulnerabilities."
  },
  {
    "id": "glossaryRecord",
    "term": "CVE Record",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryRecord",
    "definition": "Structured data about a Vulnerability associated with a CVE ID. CVE Records are authored by CNAs. A CVE Record can be in one of the following states:<ul class='cve-term-definition-list'><li><span class='cve-term-reference'><strong>Reserved</strong></span>: A CNA has reserved a CVE ID. This is the initial state of a CVE ID.</li><li><span class='cve-term-reference'><strong>Published</strong></span>: A CNA has populated the data associated with the CVE ID and published the CVE Record.</li><li><span class='cve-term-reference'><strong>Rejected</strong></span>: The CVE ID and the associated CVE Record should no longer be used. A Rejected CVE Record remains on the CVE List so that users know that the CVE ID and CVE Record are invalid.</li></ul>"
  },
  {
    "id": "glossaryWG",
    "term": "CVE Working Group",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryWG",
    "definition": "An organization created and administered by the CVE Board to accomplish specific objectives through collaboration with CVE stakeholders and the general public where appropriate."
  },
  {
    "id": "glossaryEOL",
    "term": "End of Life (EOL)",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryEOL",
    "definition": "A Product that no longer receives security Fixes. EOL typically indicates that a Product no longer receives any support, maintenance, or new features."
  },
  {
    "id": "glossaryFix",
    "term": "Fix",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryFix",
    "definition": "A change to software to remediate, mitigate, or otherwise address a vulnerability. “Fix” is used broadly and includes terms such as patch, fix, hotfix, update, and upgrade."
  },
  {
    "id": "glossaryIndependentlyFixable",
    "term": "Independently Fixable",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryIndependentlyFixable",
    "definition": "A vulnerability is independently fixable when it can be fixed without fixing a separate vulnerability."
  },
  {
    "id": "glossaryProduct",
    "term": "Product",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryProduct",
    "definition": "A unit of software or hardware or both. “Product” is used broadly and includes services, open source projects, specifications, and other common terms such as: system, appliance, device, component, library, package, archive, and collection."
  },
  {
    "id": "glossaryPubliclyDisclosed",
    "term": "Publicly Disclosed",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryPubliclyDisclosed",
    "definition": "The state in which non-trivial information about a vulnerability is publicly available. The publication of most vulnerability advisories, software updates, proof-of-concept exploit code, or other detailed information makes the vulnerability “Publicly Disclosed.”"
  },
  {
    "id": "glossaryRBP",
    "term": "Reserved but Public (RBP)",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryRBP",
    "definition": "A CVE ID in the “Reserved” state that is referenced in one or more public sources but for which a CVE Record has not been published."
  },
  {
    "id": "glossaryRoot",
    "term": "Root",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryRoot",
    "definition": "An organization authorized within the CVE Program that is responsible, within a specific Scope, for the recruitment, training, and governance of one or more entities that are a CNA, CNA-LR, or another Root."
  },
  {
    "id": "glossaryScope",
    "term": "Scope",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryScope",
    "definition": "A defined set of products, vulnerabilities, or both for which a CNA has authority and responsibility."
  },
  {
    "id": "glossarySecretariat",
    "term": "Secretariat",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossarySecretariat",
    "definition": "An organization authorized by the CVE Program to develop, host, and maintain the Program’s infrastructure and to provide administrative and logistical support for the CVE Board, CVE Working Groups, and other parts of the Program."
  },
  {
    "id": "glossarySupplier",
    "term": "Supplier",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossarySupplier",
    "definition": "The entity that develops, maintains, or provides a Product. A supplier is typically responsible for and capable of investigating vulnerability reports and developing fixes or mitigations for vulnerabilities. “Supplier” is used broadly and includes common terms such as vendor, producer, developer, maintainer, author, owner, manufacturer, and provider."
  },
  {
    "id": "glossaryTags",
    "term": "Tags",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryTags",
    "definition": "Labels used to indicate defined characteristics of CVE IDs: <ul class='cve-term-definition-list'><li><strong>exclusively-hosted-service</strong>: All known Products affected by the CVE ID exist only as fully hosted services. If the vulnerability affects both hosted services and on-premises Products, then this tag should not be used.</li><li><strong>unsupported-when-assigned</strong>: At the time of CVE ID assignment, all known Products affected by the CVE ID no longer receive security Fixes. Typically, the Products are no longer supported and are considered to be End of Life (EOL).</li><li><strong>disputed</strong>: A CVE ID assignment or CVE Record content have been disputed.</li></ul>"
  },
  {
    "id": "glossaryTLRoot",
    "term": "Top-Level Root (TL-Root)",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryTLRoot",
    "definition": "The highest-level Root responsible for the governance and administration of a specified hierarchy, including Roots and CNAs within that hierarchy."
  },
  {
    "id": "glossaryVulnerability",
    "term": "Vulnerability",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryVulnerability",
    "definition": "An instance of one or more weaknesses in a Product that can be exploited, causing a negative impact to confidentiality, integrity, or availability; a set of conditions or behaviors that allows the violation of an explicit or implicit security policy."
  },
  {
    "id": "glossaryCVEParticipants",
    "term": "CVE Program Participants",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryCVEParticipants",
    "definition": "Anyone who is an active participant in the CVE Program, including CVE Board members, CNAs, Authorized Data Publishers (ADPs), and the CVE Program Secretariat."
  },
  {
    "id": "glossaryReporter",
    "term": "Reporter",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryReporter",
    "definition": "The entity that reports a vulnerability to a CNA. It could be a security researcher, a corporate partner, an end-user, etc."
  },
  {
    "id": "glossaryADP",
    "term": "Authorized Data Publisher (ADP)",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryADP",
    "definition": "An authorized entity with specific scope and responsibility to enrich the content of CVE Records published by CVE Numbering Authorities (CNAs) with additional, pertinent information (e.g., risk scores, references, vulnerability characteristics, translations)."
  },
  {
    "id": "glossaryAdjudicator",
    "term": "Adjudicator",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryAdjudicator",
    "definition": "Organization with the role of CVE Numbering Authority (CNA), Root, or Top-Level Root (TL-Root) executing the defined Dispute Process. In cases of Dispute escalations there would be multiple Adjudicators."
  },
  {
    "id": "glossaryDispute",
    "term": "CVE Record Dispute",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryDispute",
    "definition": "Disagreements with the accuracy or completeness of a CVE Record in accordance with the CVE Program Rules, or the validity of a vulnerability upon which a CVE Record is, or could be, based."
  },
  {
    "id": "glossaryEscalation",
    "term": "Escalation",
    "termLink": "/ResourcesSupport/Glossary?activeTerm=glossaryEscalation",
    "definition": "The process by which disputes are evaluated and resolved."
  }
]