CVE assignment FAQ
Secur0 is a CNA under the INCIBE Root, so we can issue CVEs for reports in our programmes. These are the questions we get most.
How do I ask for a CVE?
You don’t. When the triage team reviews a report and sees it is eligible, we send you a form to fill in some data. If you haven’t got one and you think your report should be eligible, ask us in the report itself or open a ticket.
Can I request one somewhere else myself?
If you reported the flaw through one of our programmes, we handle it. Requesting one from another CNA as well ends up with two identifiers for the same flaw, and then one has to be withdrawn. If you have already requested one elsewhere, tell us and we’ll take it into account.
How long does publication take?
It depends on the maintainer. Some give us permission to publish as records come, and then it is usually a month or so. Others prefer to review the CVE first, or to publish alongside their own release cycle, so it can be shorter or longer depending on when they ship. Our median from a fix existing to the record being published is around 33 days, which is well below what is usual across the CVE programme.
You gave me a reserved ID, is it published?
Not yet. Reserving and publishing are two different states: a reserved ID is a number we set aside for your flaw so it’s ready when the record goes out. Having one doesn’t mean it’s published, and it isn’t authorisation to disclose yet. We’ll tell you when it is.
The company hasn’t marked the flaw as fixed, what do I do?
Careful, those are two different states. The form is sent by the triage team when it accepts the report, not when the company marks it fixed. So you may already have it, or get it before the company moves at all.
What does need the fix is publication: we don’t publish a CVE without a fix to point at. If the company has been quiet for a while, tell us and we’ll chase them. We can’t guarantee their timelines, that isn’t ours to promise, but we can push and tell you where it stands.
My report was closed as a duplicate and you still said it could get a CVE
It can happen. In specific cases, for example where a report demonstrates greater impact on an already known flaw, the triage team may decide you appear as a co-finder on a CVE alongside another person. That judgment is made by the triage team alone, case by case.
Do all programmes get CVEs?
No. We issue for versioned software under the control of whoever runs it, usually open source, because a CVE describes something you can have installed and can update. Where there is no version a user can install or update, there is no record to issue. Eligible programmes are labelled.
A programme not being eligible says nothing about your report. It’s about how the system works, not about what you found.
What will the form ask for?
The report ID, how you want your credit to read, the affected versions, the version where the vulnerable code was introduced, and a link to the patch or vendor note. The last three as far as you can manage. If you don’t have them the process takes considerably longer, because we have to work them out ourselves.
Do I put the PoC in the form?
No. That form is not an encrypted channel. No exploit code, no PoC, no detailed reproduction steps: that stays in the platform report, which we reference by its ID.
The CVE severity doesn’t match what you accepted on the report
It happens, and it isn’t us changing our minds. At CVE stage we have better evidence than when the report was assessed, usually the patch itself, which in open source normally shows what the reachable path actually was. The CVE score is decided on that evidence and it prevails. We explain it to you metric by metric.
If you think the scoring criterion itself is wrong, that gets argued in our public criticality guide, not inside the report.
Who gets credited?
Whoever found the flaw. If you report as a team, the credit goes to the team. Tell us in the form exactly how you want your name to read.
If you later want to change how you are named, for whatever reason, open a Discord ticket and we’ll do it. We’d rather get it right first time, but changing it is not a problem, and we can update how you appear in our detailed advisories too where those exist.
When can I disclose?
When we authorise it explicitly. Neither the platform certificate, nor a reserved ID, nor the maintainer publishing the patch counts as authorisation.
When you request authorisation you can propose a date, between 90 and 180 days from the request. That date becomes binding once the triage team or the company responsible for the fix approves it. Either one is enough.
It’s been weeks with no news, who do I ask?
Us. In the report if the conversation is still open, by ticket if it has been closed. You can ask about the status of your report whenever you want and it costs you nothing. We just ask that you keep it to a reasonable frequency, since we’re a small team.
What if the company never fixes it?
Then there’s no CVE, because there’s no fix to reference. Write to us anyway: there are cases where the flaw is fixed in the repository even though the company never marked it on the platform, and that we can work with.