Note 2026-2-17 Adding Additional day of processing for date normalization to addreess potential inconsistencies New Date Normalization schedule: (2/16/26 - 2/28/26)
Note 2026-2-10 Record Date Normalization
deltaLog.jsonfile change The deltaLog.json file normally retains a rolling 30 days worth of CVE record modification history. However, for the duration of the Date Normalization process (2/16/26 - 2/28/26), the deltaLog.json file will temporarily only retain 15 days worth of history. As a significant number of records will be modified, this will limit the deltaLog.json file size. During this process, the file size will be monitored to see if the number of days stored needs to be further reduced to stay under the size limit. Please note, the full history of the deltaLog file is viewable in the Git history. Once the Date Normalization process is complete, the log file will be set to once again store 30 days worth of history.
Note 2025-10-29 CVE Record Format Version 5.2.0 update as of Wednesday 10/29 at 10:30 AM EST; Supporting Package URL (PURL) identifiers: This update to the CVE Record Format (to version 5.2.0) introduces "non breaking" changes to include:
- Adding support for PURL identifiers using the packageURL propertiy with the affected array items
- Adding additionaProperites equal to false for the affected array items.
- Updating example records CVE Records (including a PURL example)
- Adding Documentation and infrastructure improvemente preparing to better support future CVE Record Format updates.
For more details see:
Note 2024-12-4 CVE REST Services was updated to use the CVE Record Format Schema 5.1.1 on Wednesday 12/4 at 4.00PM EST: This update introduces “non breaking” changes containing new features that some CNAs may be interested in using in the future (see CVE Record Format version 5.1.1 Release notes. As a fully backwards compatible update (meaning that all previously published CVE Records will validate using this schema), most users will see no operational impact as a result of this change. This schema defines the data format for CVE Records, regardless of whether they were published before or after December 4.