In 1999, MITRE created the Common Vulnerabilities and Exposures database. The system is faced with bottlenecks and coverage gaps, as thousands of vulnerabilities go without CVE-ID assignments. MITRE says it is difficult, but not impossible, to maintain consistency in CNA assignments and administration. IBM, Adobe, Cisco, Red Hat, Google, Apple, and Microsoft are among 22 organizations listed as CVE Numbering Authorities (CNAs) MITRE is primary CNA, as well as the CNA of last resort.”]

