🔒 `cyber_vuln`¶

Cybersecurity vulnerability data. Canonical vulnerability records from NVD, active exploitation catalog from CISA KEV, CWE taxonomy, and cross-source identifier mappings. Part of the govdata cyber sub-domain.

14 datasets · 67 columns

cwe_catalog · table¶

MITRE Common Weakness Enumeration (CWE) catalog. Canonical dimension table for weakness classifications referenced by NVD CVEs, CAPEC patterns, OSV entries, and OWASP Top 10. Sourced from cwec_latest.xml.zip.

Column	Type	Null	Description
`cwe_id`	string	no	CWE identifier (e.g., CWE-79)
`name`	string	yes	CWE name
`abstraction`	string	yes	Abstraction level (Class, Base, Variant, Compound)
`structure`	string	yes	Structure (Simple, Chain, Composite)
`status`	string	yes	Status (Draft, Stable, Deprecated, Incomplete, Obsolete)
`description`	string	yes	Short description
`extended_description`	string	yes	Extended description
`parent_ids`	string	yes	Pipe-delimited parent CWE IDs (ChildOf relationships)
`cwe_url`	string	yes	Canonical URL on cwe.mitre.org

vulnerabilities · table¶

NVD CVE 2.0 canonical vulnerability records. One row per CVE. CVSS V31 preferred; falls back to V2 when V31 absent. CVSS V40 stored when present. Paginated ingest via startIndex + resultsPerPage (max 2000). ~347k CVEs total.

Column	Type	Null	Description
`cve_id`	string	no	CVE identifier (e.g., CVE-2021-44228)
`published`	string	yes	Publication date (ISO 8601)
`last_modified`	string	yes	Last modification date (ISO 8601)
`vuln_status`	string	yes	Vulnerability status (Analyzed, Modified, Rejected, etc.)
`description_en`	string	yes	English description
`cvss_v2_score`	double	yes	CVSS v2 base score
`cvss_v2_vector`	string	yes	CVSS v2 vector string
`cvss_v31_score`	double	yes	CVSS v3.1 base score
`cvss_v31_vector`	string	yes	CVSS v3.1 vector string
`cvss_v31_severity`	string	yes	CVSS v3.1 severity (LOW, MEDIUM, HIGH, CRITICAL)
`cvss_v40_score`	double	yes	CVSS v4.0 base score when present
`cwe_ids`	string	yes	Pipe-delimited CWE IDs
`source`	string	yes	Feed source (nvd)
`pub_year`	integer	yes	Publication year (emitted by transformer from published; drives year partition routing)
`pub_month`	integer	yes	Publication month 1-12 (emitted by transformer from published; drives quarter routing)

vulnerability_cwes · table¶

Junction table of CVE→CWE pairs, materialized from NVD at ingest time. One row per (cve_id, cwe_id) pair. Replaces query-time UNNEST on the pipe-delimited cwe_ids column in vulnerabilities.

Column	Type	Null	Description
`cve_id`	string	no	CVE identifier
`cwe_id`	string	no	CWE identifier (e.g., CWE-79)
`pub_year`	integer	yes	Year from CVE-YYYY-NNN (emitted by transformer; drives year partition routing)
`pub_month`	integer	yes	Month placeholder 1 (emitted by transformer; CVE-year-only routing → Q1)

kev_catalog · table¶

CISA Known Exploited Vulnerabilities (KEV) catalog. Single JSON file, ~1,585 entries. No ETag/delta endpoint; diff on catalogVersion field (format YYYY.MM.DD). notes field is semicolon-delimited string of URLs, not an array. cwes array may be empty on older entries.

Column	Type	Null	Description
`cve_id`	string	no	CVE identifier
`vendor_project`	string	yes	Vendor or project name (KEV vendorProject)
`product`	string	yes	Product name
`vulnerability_name`	string	yes	Vulnerability name (KEV vulnerabilityName)
`date_added`	string	yes	Date added to KEV catalog (YYYY-MM-DD)
`short_description`	string	yes	Short description
`required_action`	string	yes	Required action for federal agencies
`due_date`	string	yes	Remediation due date for FCEB agencies (YYYY-MM-DD)
`known_ransomware_use`	string	yes	Known ransomware campaign use (Known or Unknown)
`notes_urls`	string	yes	Pipe-delimited URLs split from KEV notes field on semicolon
`cwes`	string	yes	Pipe-delimited CWE IDs from KEV cwes array (may be empty)
`catalog_version`	string	yes	Catalog version at ingest time (YYYY.MM.DD) for delta detection

kev_cwes · table¶

Junction table of KEV CVE→CWE pairs, materialized from CISA KEV at ingest time. One row per (cve_id, cwe_id) pair. Replaces query-time UNNEST on the pipe-delimited cwes column in kev_catalog.

Column	Type	Null	Description
`cve_id`	string	no	CVE identifier
`cwe_id`	string	no	CWE identifier (e.g., CWE-78)

osv_vulnerabilities · table¶

OSV (Open Source Vulnerabilities) records. One row per OSV entry. Ecosystems are a dimension (one per-ecosystem all.zip fetched per combination); the transformer standardizes a single ecosystem read from the dimension context. Includes OSV-native entries without a CVE assignment. CVE-aliased entries are also cross-referenced in vuln_cross_refs.

Column	Type	Null	Description
`osv_id`	string	no	OSV identifier (e.g., GHSA-xxxx, OSV-2021-xxx, PYSEC-2021-xxx)
`modified`	string	no	Last modification timestamp (ISO 8601)
`published`	string	yes	Publication timestamp (ISO 8601)
`withdrawn`	string	yes	Withdrawal timestamp if entry was retracted (ISO 8601)
`aliases`	string	yes	Pipe-delimited alias IDs (CVE IDs, GHSA IDs, etc.)
`summary`	string	yes	Short summary
`details`	string	yes	Detailed description (may include Markdown)
`severity_type`	string	yes	Severity type (CVSS_V3, CVSS_V4, etc.)
`severity_score`	string	yes	CVSS vector string or numeric score
`ecosystem`	string	yes	Package ecosystem (PyPI, npm, Go, Maven, etc.)
`package_name`	string	yes	Package name within the ecosystem
`package_purl`	string	yes	Package URL (purl) for the affected package
`schema_version`	string	yes	OSV schema version
`database_specific`	string	yes	JSON blob of database-specific metadata

vuln_cross_refs · table¶

Cross-reference mappings from CVE identifiers to external advisory IDs, sourced solely from GitHub Security Advisories (GHSA) via the GraphQL API (single source per the one-table = one-source rule; NVD/OSV cross-refs are derived as SQL views over their own tables). Dedup key is (cve_id, external_id, external_source); external_source is 'ghsa'. APPEND LOG: the incremental delta crawl appends changed advisories each run, so this base table may hold exact-duplicate rows across runs. Query the vuln_cross_refs_unique view for one row per (cve_id, external_id, external_source).

Column	Type	Null	Description
`cve_id`	string	no	CVE identifier (CVE-YYYY-NNNNN normalized form)
`external_id`	string	no	External identifier (GHSA ID, NVD URL slug, etc.)
`external_source`	string	no	Source system (ghsa, nvd, cisa, mitre, github, cve)
`url`	string	yes	URL of the external advisory or reference

advisories · table¶

CISA cybersecurity advisory metadata. Sourced from CISA's official CSAF GitHub repository (cisagov/CSAF, branch develop). The CsafAdvisoryDimensionResolver reads the IT/white index.txt to enumerate per-year advisory paths, and the engine fetches each CSAF 2.0 JSON file; CisaAdvisoryResponseTransformer emits one row per advisory with severity, CVE IDs, and affected systems.

Column	Type	Null	Description
`advisory_id`	string	no	Advisory identifier (e.g., AA24-001A, ICSA-24-001-01)
`source`	string	no	Advisory source (cisa)
`title`	string	yes	Advisory title
`published_date`	string	yes	Publication date (YYYY-MM-DD)
`severity`	string	yes	Severity label (CRITICAL, HIGH, MEDIUM, LOW)
`cve_ids`	string	yes	Pipe-delimited CVE IDs mentioned in the advisory
`affected_systems`	string	yes	Short description of affected products or systems

vuln_cross_refs_unique · view¶

Deduplicated CVE↔external-advisory cross-references — the serving layer for vuln_cross_refs. The base vuln_cross_refs table is an APPEND log: the incremental GHSA delta crawl appends only advisories changed since the last watermark each run, so an advisory updated across several runs (and the inclusive updatedSince boundary advisory) contributes the same (cve_id, external_id) mapping more than once. GHSA→CVE mappings are immutable, so those repeats are exact duplicates; this view collapses them to one row per (cve_id, external_id, external_source). Query this view, not the base table, for unique cross-references.