Visual Analysis of the CVE List: 2024-09-07

This exploratory analysis is focused on the data completeness and quality of the primary source for CVE data: https://github.com/CVEProject/cvelistV5. This page is an automated pass through the JSON data.

Last data pull was on 2024-09-07 and pulled 262,159 CVEs from 354 CNAs.

Each line in the table below represents a unique combinations of field and JSON type. For example, some fields may show up in the JSON as both an array and a string (e.g. containers.cna.source.defect) and will therefore show up twice in the listing below. The code will also do it’s best to count instances of objects and arrays, but the objects were a lot more difficult, you will notice NA in many of the count fields where the JSON type was an object.

Note that the JSON allows for custom fields that start with “x_”, but all of those have been removed since most the 5.0 records contain the full version 4 format of the data in x_legacyV4Record. This reduced a lot of the processing required.

JSON Field	Observed JSON	Instances	CVEs	CNAs
containers	object	262159	NA	NA
containers.adp	array	247340	247340	350
containers.adp.affected	array	13023	13023	252
containers.adp.affected.cpes	array	47496	13023	252
containers.adp.affected.defaultStatus	string	47496	13023	252
containers.adp.affected.product	string	47496	13023	252
containers.adp.affected.vendor	string	47496	13023	252
containers.adp.affected.versions	array	47496	13023	252
...ainers.adp.affected.versions.lessThan	string	9962	4051	194
...adp.affected.versions.lessThanOrEqual	string	29166	3734	171
containers.adp.affected.versions.status	string	56047	13023	252
containers.adp.affected.versions.version	string	56047	13021	252
...ers.adp.affected.versions.versionType	string	39128	7548	241
containers.adp.descriptions	array	2	2	2
containers.adp.descriptions.lang	string	2	2	2
containers.adp.descriptions.value	string	2	2	2
containers.adp.metrics	array	26039	26039	279
containers.adp.metrics.cvssV3_1	object	4661	NA	NA
...adp.metrics.cvssV3_1.attackComplexity	string	4660	4660	84
...ers.adp.metrics.cvssV3_1.attackVector	string	4660	4660	84
...p.metrics.cvssV3_1.availabilityImpact	string	4660	4660	84
...ainers.adp.metrics.cvssV3_1.baseScore	number	4661	4661	84
...ers.adp.metrics.cvssV3_1.baseSeverity	string	4661	4661	84
...etrics.cvssV3_1.confidentialityImpact	string	4660	4660	84
....adp.metrics.cvssV3_1.integrityImpact	string	4660	4660	84
...p.metrics.cvssV3_1.privilegesRequired	string	4660	4660	84
containers.adp.metrics.cvssV3_1.scope	string	4660	4660	84
....adp.metrics.cvssV3_1.userInteraction	string	4660	4660	84
...ers.adp.metrics.cvssV3_1.vectorString	string	4661	4661	84
containers.adp.metrics.cvssV3_1.version	string	4661	4661	84
containers.adp.metrics.format	string	5	5	5
containers.adp.metrics.other	object	26183	NA	NA
containers.adp.metrics.other.content	object	26183	NA	NA
...s.adp.metrics.other.content.dateAdded	string	144	144	42
containers.adp.metrics.other.content.id	string	26038	26038	279
...s.adp.metrics.other.content.namespace	string	1	1	1
...ers.adp.metrics.other.content.options	array	26038	26038	279
...ics.other.content.options.Automatable	string	26038	26038	279
...cs.other.content.options.Exploitation	string	26038	26038	279
...ther.content.options.Technical Impact	string	26038	26038	279
...s.adp.metrics.other.content.reference	string	144	144	42
...ainers.adp.metrics.other.content.role	string	26038	26038	279
...s.adp.metrics.other.content.timestamp	string	26038	26038	279
...iners.adp.metrics.other.content.value	string	1	1	1
...ers.adp.metrics.other.content.version	string	26038	26038	279
containers.adp.metrics.other.type	string	26183	26039	279
containers.adp.metrics.scenarios	array	5	5	5
containers.adp.metrics.scenarios.lang	string	5	5	5
containers.adp.metrics.scenarios.value	string	5	5	5
containers.adp.problemTypes	array	4343	4343	99
containers.adp.problemTypes.descriptions	array	4455	4343	99
...s.adp.problemTypes.descriptions.cweId	string	4448	4339	99
...problemTypes.descriptions.description	string	4455	4342	99
...rs.adp.problemTypes.descriptions.lang	string	4455	4343	99
...rs.adp.problemTypes.descriptions.type	string	4455	4343	99
containers.adp.providerMetadata	object	270334	NA	NA
...ners.adp.providerMetadata.dateUpdated	string	270334	247340	350
containers.adp.providerMetadata.orgId	string	270334	247340	350
...ainers.adp.providerMetadata.shortName	string	270334	247340	350
containers.adp.references	array	244312	244295	342
containers.adp.references.name	string	512940	124112	129
containers.adp.references.tags	array	903756	244213	341
containers.adp.references.url	string	904189	244295	342
containers.adp.timeline	array	35	35	15
containers.adp.timeline.lang	string	40	35	15
containers.adp.timeline.time	string	40	35	15
containers.adp.timeline.value	string	40	35	15
containers.adp.title	string	270334	247340	350
containers.adp.x_generator	object	26	NA	NA
containers.cna	object	262159	NA	NA
containers.cna.affected	array	247740	247740	350
containers.cna.affected.collectionURL	string	11315	6630	46
containers.cna.affected.cpes	array	55985	4947	9
containers.cna.affected.defaultStatus	string	55315	30089	295
containers.cna.affected.modules	array	2553	1894	85
containers.cna.affected.packageName	string	10714	5647	64
containers.cna.affected.platforms	array	55048	6988	166
containers.cna.affected.product	string	351205	112076	349
containers.cna.affected.programFiles	array	6223	3154	22
containers.cna.affected.programRoutines	array	135	116	11
...ers.cna.affected.programRoutines.name	string	914	116	11
containers.cna.affected.repo	string	6904	3796	73
containers.cna.affected.vendor	string	351171	97319	344
containers.cna.affected.versionType	string	743	1	1
containers.cna.affected.versions	array	348769	247584	350
containers.cna.affected.versions.changes	array	4766	3758	53
...ners.cna.affected.versions.changes.at	string	4943	3758	53
....cna.affected.versions.changes.status	string	4943	3758	53
...ainers.cna.affected.versions.lessThan	string	120542	29076	257
...cna.affected.versions.lessThanOrEqual	string	41360	20754	211
containers.cna.affected.versions.status	string	607750	247584	350
containers.cna.affected.versions.version	string	607750	104779	349
...ers.cna.affected.versions.versionType	string	162146	46258	295
containers.cna.configurations	array	590	590	47
containers.cna.configurations.lang	string	597	590	47
...rs.cna.configurations.supportingMedia	array	212	210	34
...configurations.supportingMedia.base64	logical	212	NA	NA
...a.configurations.supportingMedia.type	string	212	210	34
....configurations.supportingMedia.value	string	212	210	34
containers.cna.configurations.value	string	597	590	47
containers.cna.credits	array	27722	27722	239
containers.cna.credits.lang	string	31126	27722	239
containers.cna.credits.type	string	21694	18656	199
containers.cna.credits.user	string	7932	7467	138
containers.cna.credits.value	string	31126	27721	239
containers.cna.dateAssigned	string	2072	2072	10
containers.cna.datePublic	string	127945	127945	265
containers.cna.descriptions	array	247740	247740	350
containers.cna.descriptions.lang	string	251882	247740	350
...ners.cna.descriptions.supportingMedia	array	15445	15445	259
...a.descriptions.supportingMedia.base64	logical	15445	NA	NA
...cna.descriptions.supportingMedia.type	string	15445	15445	259
...na.descriptions.supportingMedia.value	string	15445	15445	259
containers.cna.descriptions.value	string	251882	247740	350
containers.cna.exploits	array	3361	3361	32
containers.cna.exploits.lang	string	3362	3361	32
containers.cna.exploits.supportingMedia	array	272	272	15
...s.cna.exploits.supportingMedia.base64	logical	272	NA	NA
...ers.cna.exploits.supportingMedia.type	string	272	272	15
...rs.cna.exploits.supportingMedia.value	string	272	272	15
containers.cna.exploits.value	string	3362	3361	32
containers.cna.impacts	array	7099	7099	210
containers.cna.impacts.capecId	string	7023	6813	205
containers.cna.impacts.descriptions	array	7317	7099	210
containers.cna.impacts.descriptions.lang	string	7317	7099	210
...ainers.cna.impacts.descriptions.value	string	7317	7099	210
containers.cna.metrics	array	63620	63620	305
containers.cna.metrics.cvssV2_0	object	4077	NA	NA
...cna.metrics.cvssV2_0.accessComplexity	string	37	37	2
...ers.cna.metrics.cvssV2_0.accessVector	string	37	37	2
...s.cna.metrics.cvssV2_0.authentication	string	37	37	2
...a.metrics.cvssV2_0.availabilityImpact	string	37	37	2
...ainers.cna.metrics.cvssV2_0.baseScore	number	4077	4077	3
...etrics.cvssV2_0.confidentialityImpact	string	37	37	2
....cna.metrics.cvssV2_0.integrityImpact	string	37	37	2
...ers.cna.metrics.cvssV2_0.vectorString	string	4077	4077	3
containers.cna.metrics.cvssV2_0.version	string	4077	4077	3
containers.cna.metrics.cvssV3_0	object	16786	NA	NA
...cna.metrics.cvssV3_0.attackComplexity	string	11409	11409	48
...ers.cna.metrics.cvssV3_0.attackVector	string	11409	11409	48
...a.metrics.cvssV3_0.availabilityImpact	string	11409	11409	48
...ainers.cna.metrics.cvssV3_0.baseScore	number	16786	16786	51
...ers.cna.metrics.cvssV3_0.baseSeverity	string	16786	16786	51
...etrics.cvssV3_0.confidentialityImpact	string	11409	11409	48
....metrics.cvssV3_0.exploitCodeMaturity	string	2314	2314	2
....cna.metrics.cvssV3_0.integrityImpact	string	11409	11409	48
...a.metrics.cvssV3_0.privilegesRequired	string	11409	11409	48
...cna.metrics.cvssV3_0.remediationLevel	string	2314	2314	2
...cna.metrics.cvssV3_0.reportConfidence	string	2314	2314	2
containers.cna.metrics.cvssV3_0.scope	string	11409	11409	48
...rs.cna.metrics.cvssV3_0.temporalScore	number	2314	2314	2
...cna.metrics.cvssV3_0.temporalSeverity	string	2314	2314	2
....cna.metrics.cvssV3_0.userInteraction	string	11409	11409	48
...ers.cna.metrics.cvssV3_0.vectorString	string	16786	16786	51
containers.cna.metrics.cvssV3_0.version	string	16786	16786	51
containers.cna.metrics.cvssV3_1	object	49828	NA	NA
...cna.metrics.cvssV3_1.attackComplexity	string	37578	37554	282
...ers.cna.metrics.cvssV3_1.attackVector	string	37578	37554	282
...a.metrics.cvssV3_1.availabilityImpact	string	37578	37554	282
...rics.cvssV3_1.availabilityRequirement	string	878	878	3
...ainers.cna.metrics.cvssV3_1.baseScore	number	49828	49804	287
...ers.cna.metrics.cvssV3_1.baseSeverity	string	49828	49804	287
...etrics.cvssV3_1.confidentialityImpact	string	37578	37554	282
...s.cvssV3_1.confidentialityRequirement	string	878	878	3
...a.metrics.cvssV3_1.environmentalScore	number	878	878	3
...etrics.cvssV3_1.environmentalSeverity	string	878	878	3
....metrics.cvssV3_1.exploitCodeMaturity	string	1398	1398	9
....cna.metrics.cvssV3_1.integrityImpact	string	37578	37554	282
...metrics.cvssV3_1.integrityRequirement	string	878	878	3
...ics.cvssV3_1.modifiedAttackComplexity	string	878	878	3
...metrics.cvssV3_1.modifiedAttackVector	string	878	878	3
...s.cvssV3_1.modifiedAvailabilityImpact	string	878	878	3
...vssV3_1.modifiedConfidentialityImpact	string	878	878	3
...rics.cvssV3_1.modifiedIntegrityImpact	string	878	878	3
...s.cvssV3_1.modifiedPrivilegesRequired	string	878	878	3
...rs.cna.metrics.cvssV3_1.modifiedScope	string	878	878	3
...rics.cvssV3_1.modifiedUserInteraction	string	878	878	3
...a.metrics.cvssV3_1.privilegesRequired	string	37578	37554	282
...cna.metrics.cvssV3_1.remediationLevel	string	1398	1398	9
...cna.metrics.cvssV3_1.reportConfidence	string	1398	1398	9
containers.cna.metrics.cvssV3_1.scope	string	37578	37554	282
...rs.cna.metrics.cvssV3_1.temporalScore	number	1398	1398	9
...cna.metrics.cvssV3_1.temporalSeverity	string	1398	1398	9
....cna.metrics.cvssV3_1.userInteraction	string	37578	37554	282
...ers.cna.metrics.cvssV3_1.vectorString	string	49828	49804	287
containers.cna.metrics.cvssV3_1.version	string	49828	49804	287
containers.cna.metrics.cvssV4_0	object	1623	NA	NA
...ners.cna.metrics.cvssV4_0.Automatable	string	499	496	72
containers.cna.metrics.cvssV4_0.Recovery	string	499	496	72
containers.cna.metrics.cvssV4_0.Safety	string	499	496	72
...cna.metrics.cvssV4_0.attackComplexity	string	560	557	74
...a.metrics.cvssV4_0.attackRequirements	string	560	557	74
...ers.cna.metrics.cvssV4_0.attackVector	string	560	557	74
...ainers.cna.metrics.cvssV4_0.baseScore	number	1623	1620	77
...ers.cna.metrics.cvssV4_0.baseSeverity	string	1623	1620	77
...a.metrics.cvssV4_0.privilegesRequired	string	560	557	74
....cna.metrics.cvssV4_0.providerUrgency	string	499	496	72
...etrics.cvssV4_0.subAvailabilityImpact	string	560	557	74
...ics.cvssV4_0.subConfidentialityImpact	string	560	557	74
...a.metrics.cvssV4_0.subIntegrityImpact	string	560	557	74
....cna.metrics.cvssV4_0.userInteraction	string	560	557	74
...ers.cna.metrics.cvssV4_0.valueDensity	string	499	496	72
...ers.cna.metrics.cvssV4_0.vectorString	string	1623	1620	77
containers.cna.metrics.cvssV4_0.version	string	1623	1620	77
...trics.cvssV4_0.vulnAvailabilityImpact	string	560	557	74
...cs.cvssV4_0.vulnConfidentialityImpact	string	560	557	74
....metrics.cvssV4_0.vulnIntegrityImpact	string	560	557	74
....cvssV4_0.vulnerabilityResponseEffort	string	499	496	72
containers.cna.metrics.format	string	23079	22838	271
containers.cna.metrics.other	object	1375	NA	NA
containers.cna.metrics.other.content	object	1375	NA	NA
...cna.metrics.other.content.Automatable	string	1	NA	NA
...na.metrics.other.content.Exploitation	string	1	NA	NA
...etrics.other.content.Technical Impact	string	1	NA	NA
...a.metrics.other.content.Value Density	string	1	NA	NA
...etrics.other.content.attackComplexity	string	38	NA	NA
...na.metrics.other.content.attackVector	string	38	NA	NA
...rics.other.content.availabilityImpact	string	38	NA	NA
...s.cna.metrics.other.content.baseScore	number	36	NA	NA
...na.metrics.other.content.baseSeverity	string	38	NA	NA
...s.other.content.confidentialityImpact	string	38	NA	NA
...cna.metrics.other.content.description	object	88	NA	NA
....content.description.description_data	array	88	88	1
...ent.description.description_data.lang	string	88	88	1
...nt.description.description_data.value	string	88	88	1
...metrics.other.content.integrityImpact	string	38	NA	NA
...ainers.cna.metrics.other.content.lang	string	44	NA	NA
...s.cna.metrics.other.content.namespace	string	523	NA	NA
...iners.cna.metrics.other.content.other	string	195	NA	NA
...rics.other.content.privilegesRequired	string	38	NA	NA
...iners.cna.metrics.other.content.scope	string	38	NA	NA
...ainers.cna.metrics.other.content.ssvc	string	1	NA	NA
...ainers.cna.metrics.other.content.text	string	434	NA	NA
containers.cna.metrics.other.content.url	string	44	NA	NA
...metrics.other.content.userInteraction	string	38	NA	NA
...iners.cna.metrics.other.content.value	string	567	NA	NA
...na.metrics.other.content.vectorString	string	89	NA	NA
...ers.cna.metrics.other.content.version	string	3	NA	NA
...ers.cna.metrics.other.content.version	number	25	NA	NA
containers.cna.metrics.other.type	string	1375	1375	12
containers.cna.metrics.scenarios	array	20523	20282	262
containers.cna.metrics.scenarios.lang	string	20524	20282	262
containers.cna.metrics.scenarios.value	string	20524	20282	262
containers.cna.problemTypes	array	241783	241783	346
containers.cna.problemTypes.descriptions	array	243811	241783	346
...s.cna.problemTypes.descriptions.cweId	string	57965	56338	321
...problemTypes.descriptions.description	string	244396	105907	345
...rs.cna.problemTypes.descriptions.lang	string	244396	241783	346
...rs.cna.problemTypes.descriptions.type	string	237003	235008	340
containers.cna.providerMetadata	object	262159	NA	NA
...ners.cna.providerMetadata.dateUpdated	string	262157	262157	354
containers.cna.providerMetadata.orgId	string	262159	262159	354
...ainers.cna.providerMetadata.shortName	string	262147	262147	354
containers.cna.references	array	247740	247740	350
containers.cna.references.name	string	515060	124969	129
containers.cna.references.tags	array	816067	209628	272
containers.cna.references.url	string	911804	247740	350
containers.cna.rejectedReasons	array	14419	14419	151
containers.cna.rejectedReasons.lang	string	14419	14419	151
...s.cna.rejectedReasons.supportingMedia	array	201	201	32
...ejectedReasons.supportingMedia.base64	logical	201	NA	NA
....rejectedReasons.supportingMedia.type	string	201	201	32
...rejectedReasons.supportingMedia.value	string	201	201	32
containers.cna.rejectedReasons.value	string	14419	14419	151
containers.cna.replacedBy	array	27	27	7
containers.cna.solutions	array	9351	9351	145
containers.cna.solutions.lang	string	9453	9351	145
containers.cna.solutions.supportingMedia	array	5750	5694	110
....cna.solutions.supportingMedia.base64	logical	5750	NA	NA
...rs.cna.solutions.supportingMedia.type	string	5750	5694	110
...s.cna.solutions.supportingMedia.value	string	5750	5694	110
containers.cna.solutions.value	string	9453	9351	145
containers.cna.source	object	39849	NA	NA
containers.cna.source.advisory	string	14761	14761	91
containers.cna.source.defect	array	4970	19	1
containers.cna.source.defect	string	19	19	1
containers.cna.source.defects	array	349	349	1
containers.cna.source.discovery	string	38772	38772	298
containers.cna.source.found_during	string	1	1	1
containers.cna.source.lang	string	949	949	1
containers.cna.source.value	string	949	949	1
containers.cna.tags	array	1648	1648	40
containers.cna.taxonomyMappings	array	2	2	1
...ers.cna.taxonomyMappings.taxonomyName	string	2	2	1
...na.taxonomyMappings.taxonomyRelations	array	2	2	1
...gs.taxonomyRelations.relationshipName	string	2	2	1
...s.taxonomyRelations.relationshipValue	string	2	2	1
...Mappings.taxonomyRelations.taxonomyId	string	2	2	1
....cna.taxonomyMappings.taxonomyVersion	string	2	2	1
containers.cna.timeline	array	8294	8294	26
containers.cna.timeline.lang	string	20659	8294	26
containers.cna.timeline.time	string	20659	8294	26
containers.cna.timeline.value	string	20659	8294	26
containers.cna.title	string	50428	50428	282
containers.cna.workarounds	array	2079	2079	98
containers.cna.workarounds.lang	string	2134	2079	98
...iners.cna.workarounds.supportingMedia	array	569	561	64
...na.workarounds.supportingMedia.base64	logical	569	NA	NA
....cna.workarounds.supportingMedia.type	string	569	561	64
...cna.workarounds.supportingMedia.value	string	569	561	64
containers.cna.workarounds.value	string	2134	2078	98
containers.cna.x_ConverterErrors	object	366	NA	NA
containers.cna.x_generator	object	25896	2389	6
containers.cna.x_generator	string	2389	2389	6
containers.cna.x_legacyV4Record	object	175573	NA	NA
containers.cna.x_redhatCweChain	string	509	509	2
cveMetadata	object	262159	NA	NA
cveMetadata.assignerOrgId	string	262159	262159	354
cveMetadata.assignerShortName	string	262154	262154	353
cveMetadata.cveId	string	262159	262159	354
cveMetadata.datePublished	string	258618	258618	352
cveMetadata.dateRejected	string	14418	14418	151
cveMetadata.dateReserved	string	261653	261653	354
cveMetadata.dateUpdated	string	262159	262159	354
cveMetadata.requesterUserId	string	690	690	56
cveMetadata.serial	number	53	53	12
cveMetadata.state	string	262159	262159	354
dataType	string	262159	262159	354
dataVersion	string	262159	262159	354
base64	NA	NA	210	34
base64	NA	NA	15445	259
base64	NA	NA	272	15
base64	NA	NA	201	32
base64	NA	NA	5694	110
base64	NA	NA	561	64

CNAs as proportion of CVEs