The Energy and Commerce Committee sent letters to MITRE and the Department of Homeland Security. They recommend some needed changes to the troubled CVE program. MITRE created the CVE database in 1999 as a means of standardizing the naming convention of disclosed vulnerabilities. Researchers were frustrated by the program, due to the fact it could take several weeks or months to get a CVE assigned. Some vulnerabilities were rejected outright, as they were viewed as being out of scope. Committee members suggested that this process be changed, urging DHS to transition the CVE program from a contract-based funding model to a PPA.”]