You issue the advisories everyone else consumes. You are on the supply side of the record. The question is never what a CVE means; it is whether your assignment practice is consistent with your peers', and whether the researcher citing prior art at you is right.
CNA, CWE, CVSS vector and affected product for any CVE you name: pinned, dated, and precise enough to cite internally.
Assigning CNA, CWE mapping, CVSS vector at a pinned version and affected product string, for every case record we hold: the four fields your peer-comparison question turns on.
Identifier-level precision with a receipt behind it, because this ends up in a public advisory and an imprecise vector is a public mistake.
Post-cutoff records included, so the comparison covers the advisories being written now rather than the ones a frontier model was trained on.
Natural language, no query syntax. Facts come back in about 226 ms; the interpretation follows.
CVE-2026-15572 and CVE-2026-15573 are both Red Hat Keycloak. What CWEs did they use, and what were the vectors?
How does the record name the affected product for CVE-2026-50623 versus CVE-2026-54225: same string or different?
Are Cisco's CVSS scores running harsher than Red Hat's? Take CVE-2026-20263 and CVE-2026-15572 as the examples.
I need to know how other CNAs mapped this weakness class before I commit to a CWE in public.
My advisory affected-product strings are inconsistent across five years and nobody noticed.
I want to know whether our CVSS scoring is systematically harsher or softer than our peers'.
Researchers cite prior CVEs at me and I cannot check the claim quickly.
Every line carries a status. Nothing here is a roadmap item wearing a present tense.
All four fields are held per record and answer in one turn. Set-wide comparison across the whole record is not built. Retrieval is keyed on CVE id, one at a time. Name the CVEs and it answers; there is no product-scoped, CNA-scoped or set-wide query path in the shipped console.
Two clocks per fact: when it was true upstream, and when we learned it. A fact recorded after your as-of date structurally cannot leak into the answer, because the constraint is a SQL predicate rather than a filter applied afterwards.
Every CVE in the corpus postdates every frontier training cutoff. We score 90.86 studied on them. Opus 5 scores 0.0, Gemini 0.2.
Ruled on the last full run, 2026-08-20: denial 0/3, every probe that tried to make it deny a real record was declined correctly rather than denied. Fabrication 7/17, and five of those seven had no fact block served at all. Live defect recorded in the same pass: three correct declines dropped the year from the identifier.
Stated once, plainly, so nothing downstream is designed around a fiction.
You can ask what a peer's mapping was, not whether it was correct. The corpus holds no standards text, so scoring methodology is out of scope.
You can pull the entire CVE List yourself for free. This is convenience, freshness and a receipt, not access you lack.
An identifier defect is expensive in this seat: the last run recorded three correct declines that dropped the year from the CVE id.
Scored gates from the last full run — 70 questions through the shipped path. A gate that needs human judgement is reported as judged, with its ruling method, rather than counted as passed.
No answer stated that a specific version is or is not affected.
Three answers self-reported a fact newer than the turn's pinned as-of.
Two turns returned nothing. Token-budget exhaustion, not refusal.
Both requests the guard should have refused were refused.
Seven of seventeen probes written to provoke a fabrication succeeded.
No answer denied that a real record exists. It declines instead.