🔒 `cyber_vuln`¶

Cybersecurity vulnerability data. Canonical vulnerability records from NVD, active exploitation catalog from CISA KEV, CWE taxonomy, and cross-source identifier mappings. Part of the govdata cyber sub-domain.

14 datasets · 67 columns

cwe_catalog · table¶

MITRE Common Weakness Enumeration (CWE) catalog, one row per CWE ID (e.g., CWE-79) with name, abstraction level (Class/Base/Variant/Compound), structure, status, and description. Full-catalog snapshot sourced from cwec_latest.xml.zip, refreshed weekly. Canonical dimension joined to NVD CVEs via vulnerability_cwes, to CISA KEV via kev_cwes, and to cyber_threat.owasp_top10 in the vuln_threat_chain view.

Column	Type	Null	Description
`cwe_id`	string	no	CWE identifier (e.g., CWE-79)
`name`	string	yes	CWE name
`abstraction`	string	yes	Abstraction level (Class, Base, Variant, Compound)
`structure`	string	yes	Structure (Simple, Chain, Composite)
`status`	string	yes	Status (Draft, Stable, Deprecated, Incomplete, Obsolete)
`description`	string	yes	Short description
`extended_description`	string	yes	Extended description
`parent_ids`	string	yes	Pipe-delimited parent CWE IDs (ChildOf relationships)
`cwe_url`	string	yes	Canonical URL on cwe.mitre.org

vulnerabilities · table¶

NVD CVE 2.0 canonical vulnerability records, one row per CVE, partitioned by publication year and quarter. NVD's own catalog spans 1999-present (~347k CVEs total), but this table's own observedCoverage below is the source of truth for what's actually loaded here — check it rather than assuming the two match. Stores CVSS v2 and v3.1 base scores with their vector strings, plus a CVSS v4.0 base score (no v4.0 vector column), vuln_status, and pipe-delimited CWE IDs. The canonical CVE registry — see kev_catalog for the smaller subset known to be actively exploited, and vulnerability_cwes for the CVE-to-CWE junction.

Column	Type	Null	Description
`cve_id`	string	no	CVE identifier (e.g., CVE-2021-44228)
`published`	string	yes	Publication date (ISO 8601)
`last_modified`	string	yes	Last modification date (ISO 8601)
`vuln_status`	string	yes	Vulnerability status (Analyzed, Modified, Rejected, etc.)
`description_en`	string	yes	English description
`cvss_v2_score`	double	yes	CVSS v2 base score
`cvss_v2_vector`	string	yes	CVSS v2 vector string
`cvss_v31_score`	double	yes	CVSS v3.1 base score
`cvss_v31_vector`	string	yes	CVSS v3.1 vector string
`cvss_v31_severity`	string	yes	CVSS v3.1 severity (LOW, MEDIUM, HIGH, CRITICAL)
`cvss_v40_score`	double	yes	CVSS v4.0 base score when present
`cwe_ids`	string	yes	Pipe-delimited CWE IDs
`source`	string	yes	Feed source (nvd)
`pub_year`	integer	yes	Publication year (emitted by transformer from published; drives year partition routing)
`pub_month`	integer	yes	Publication month 1-12 (emitted by transformer from published; drives quarter routing)

vulnerability_cwes · table¶

Junction table of CVE→CWE pairs, materialized from NVD at ingest time. One row per (cve_id, cwe_id) pair. Replaces query-time UNNEST on the pipe-delimited cwe_ids column in vulnerabilities.

Column	Type	Null	Description
`cve_id`	string	no	CVE identifier
`cwe_id`	string	no	CWE identifier (e.g., CWE-79)
`pub_year`	integer	yes	Year from CVE-YYYY-NNN (emitted by transformer; drives year partition routing)
`pub_month`	integer	yes	Month placeholder 1 (emitted by transformer; CVE-year-only routing → Q1)

kev_catalog · table¶

CISA Known Exploited Vulnerabilities (KEV) catalog: one row per CVE known to be actively exploited in the wild, ~1,585 entries. Carries vendor_project, product, vulnerability_name, date_added to KEV, the FCEB remediation due_date, and a known_ransomware_use flag — no CVSS scores are included here. A curated subset of the full NVD catalog in vulnerabilities (join on cve_id); see kev_enriched or kev_cross_threat for KEV joined with NVD CVSS scores and CWE names.

Column	Type	Null	Description
`cve_id`	string	no	CVE identifier
`vendor_project`	string	yes	Vendor or project name (KEV vendorProject)
`product`	string	yes	Product name
`vulnerability_name`	string	yes	Vulnerability name (KEV vulnerabilityName)
`date_added`	string	yes	Date added to KEV catalog (YYYY-MM-DD)
`short_description`	string	yes	Short description
`required_action`	string	yes	Required action for federal agencies
`due_date`	string	yes	Remediation due date for FCEB agencies (YYYY-MM-DD)
`known_ransomware_use`	string	yes	Known ransomware campaign use (Known or Unknown)
`notes_urls`	string	yes	Pipe-delimited URLs split from KEV notes field on semicolon
`cwes`	string	yes	Pipe-delimited CWE IDs from KEV cwes array (may be empty)
`catalog_version`	string	yes	Catalog version at ingest time (YYYY.MM.DD) for delta detection

kev_cwes · table¶

Junction table of KEV CVE→CWE pairs, materialized from CISA KEV at ingest time. One row per (cve_id, cwe_id) pair. Replaces query-time UNNEST on the pipe-delimited cwes column in kev_catalog.

Column	Type	Null	Description
`cve_id`	string	no	CVE identifier
`cwe_id`	string	no	CWE identifier (e.g., CWE-78)

osv_vulnerabilities · table¶

OSV (Open Source Vulnerabilities) records for open-source package ecosystems (PyPI, npm, Go, Maven, RubyGems, NuGet, Packagist, Hex, Pub, CRAN), one row per OSV entry (osv_id, e.g. GHSA-xxxx, PYSEC-2021-xxx), partitioned by ecosystem and refreshed weekly. Carries severity type/score, package name and purl, and pipe-delimited alias IDs including CVE IDs where assigned — includes OSV-native entries with no CVE assignment. Not part of vuln_cross_refs, which is sourced solely from GitHub Security Advisories.

Column	Type	Null	Description
`osv_id`	string	no	OSV identifier (e.g., GHSA-xxxx, OSV-2021-xxx, PYSEC-2021-xxx)
`modified`	string	no	Last modification timestamp (ISO 8601)
`published`	string	yes	Publication timestamp (ISO 8601)
`withdrawn`	string	yes	Withdrawal timestamp if entry was retracted (ISO 8601)
`aliases`	string	yes	Pipe-delimited alias IDs (CVE IDs, GHSA IDs, etc.)
`summary`	string	yes	Short summary
`details`	string	yes	Detailed description (may include Markdown)
`severity_type`	string	yes	Severity type (CVSS_V3, CVSS_V4, etc.)
`severity_score`	string	yes	CVSS vector string or numeric score
`ecosystem`	string	yes	Package ecosystem (PyPI, npm, Go, Maven, etc.)
`package_name`	string	yes	Package name within the ecosystem
`package_purl`	string	yes	Package URL (purl) for the affected package
`schema_version`	string	yes	OSV schema version
`database_specific`	string	yes	JSON blob of database-specific metadata

vuln_cross_refs · table¶

Cross-reference mappings from CVE identifiers to external advisory IDs, sourced solely from GitHub Security Advisories (GHSA) via the GraphQL API (single source per the one-table = one-source rule; NVD/OSV cross-refs are derived as SQL views over their own tables). Dedup key is (cve_id, external_id, external_source); external_source is 'ghsa'. APPEND LOG: the incremental delta crawl appends changed advisories each run, so this base table may hold exact-duplicate rows across runs. Query the vuln_cross_refs_unique view for one row per (cve_id, external_id, external_source).

Column	Type	Null	Description
`cve_id`	string	no	CVE identifier (CVE-YYYY-NNNNN normalized form)
`external_id`	string	no	External identifier (GHSA ID, NVD URL slug, etc.)
`external_source`	string	no	Source system (ghsa, nvd, cisa, mitre, github, cve)
`url`	string	yes	URL of the external advisory or reference

advisories · table¶

CISA cybersecurity advisory metadata, one row per advisory (e.g., AA24-001A, ICSA-24-001-01), partitioned by year. CISA's own feed goes back to 2017, but this table's own observedCoverage below is the source of truth for what's actually loaded here — check it rather than assuming the two match. Refreshed weekly. Carries title, published_date, severity label, pipe-delimited CVE IDs mentioned in the advisory, and a short affected_systems description. Sourced from CISA's official CSAF 2.0 JSON feed (cisagov/CSAF GitHub repo).

Column	Type	Null	Description
`advisory_id`	string	no	Advisory identifier (e.g., AA24-001A, ICSA-24-001-01)
`source`	string	no	Advisory source (cisa)
`title`	string	yes	Advisory title
`published_date`	string	yes	Publication date (YYYY-MM-DD)
`severity`	string	yes	Severity label (CRITICAL, HIGH, MEDIUM, LOW)
`cve_ids`	string	yes	Pipe-delimited CVE IDs mentioned in the advisory
`affected_systems`	string	yes	Short description of affected products or systems

vuln_cross_refs_unique · view¶

Deduplicated CVE↔external-advisory cross-references — the serving layer for vuln_cross_refs. The base vuln_cross_refs table is an APPEND log: the incremental GHSA delta crawl appends only advisories changed since the last watermark each run, so an advisory updated across several runs (and the inclusive updatedSince boundary advisory) contributes the same (cve_id, external_id) mapping more than once. GHSA→CVE mappings are immutable, so those repeats are exact duplicates; this view collapses them to one row per (cve_id, external_id, external_source). Query this view, not the base table, for unique cross-references.