- What: RedEye Security LLC has been authorized by the CVE Program as a CVE Numbering Authority (CNA), one of the organizations responsible for assigning CVE IDs to vulnerabilities and publishing the CVE Records that describe them.
- Impact: Vulnerabilities in RedEye products now receive a CVE ID and a published CVE Record from RedEye directly, so defenders everywhere can reference, correlate, and prioritize them consistently.
- What you can do: Report a security issue in a RedEye product to
[email protected]. A valid, in-scope finding receives a CVE ID and public credit under our coordinated-disclosure policy. - Who it affects: Anyone who deploys and operates Caver in their own environment, and any researcher who reports an issue in it.
RedEye Security has been authorized by the CVE Program as a CVE Numbering Authority. It is a step we take as the company that builds and operates its own security software: we hold our products to the same disclosure standard we ask of everyone else, and now we assign and publish the CVE Records for them ourselves.
What a CNA Actually Is
A CVE Numbering Authority is an organization responsible for the regular assignment of CVE IDs to vulnerabilities, and for creating and publishing the CVE Record that describes each one. Every CVE Record on the CVE List is assigned by a CNA. Each CNA has a specific scope of responsibility for which vulnerabilities it identifies and publishes.
In practice, being a CNA changes how a vulnerability in one of our products travels. When an issue is found and validated, we assign it a CVE ID and publish the CVE Record ourselves, on a coordinated timeline, rather than routing it through a third party. The record carries a single, consistent description that anyone can reference, and it flows into the U.S. National Vulnerability Database and from there into the scanners and SIEMs that defenders already run.
What CVE Is, and Why It Is Worth Doing
The mission of the Common Vulnerabilities and Exposures (CVE) Program is to identify, define, and catalog publicly disclosed cybersecurity vulnerabilities. There is one CVE Record for each vulnerability in the catalog. Partners publish CVE Records to communicate consistent descriptions, so that information technology and cybersecurity professionals can be sure they are discussing the same issue, and can coordinate how they prioritize and fix it.
The value is simple and it is the reason the program exists: CVE lets two or more people or tools refer to a vulnerability and know they are talking about the same thing. That shared reference saves real time and cost, on every side of a disclosure.
The CVE Program relies on the community to discover vulnerabilities, which are then assigned and published by partner organizations around the world. The CVE Board that sets the program's direction is drawn from industry, academia, and government internationally, and the working groups that develop program policy are open to the community. RedEye joins that community of partners as a CNA.
Our Scope
Our CNA scope covers vulnerabilities in RedEye Security's own products: software that RedEye develops and distributes for customers to deploy and operate in their own environments. Today that is Caver, our self-hosted, Splunk-compatible SIEM and OCSF data-lake platform, including its server components, collectors and agents, command-line tooling, and officially distributed installers and container images.
Out of scope:
- Vulnerabilities in third-party components and dependencies that RedEye redistributes but does not maintain. Those stay with the responsible upstream CNA.
- Vulnerabilities in RedEye-operated hosted services and web properties that RedEye remediates server-side with no customer action required.
- The content of RedEye's threat-intelligence and CVE detection feeds.
Reports about anything on that list are still accepted and fixed, they just do not receive a CVE ID from us. For a vulnerability outside our scope, we will point you to the appropriate CNA or to the CVE Program, and we will not assign a CVE ID ourselves.
What It Means if You Run Our Products
A CVE Record is a shared reference. When we ship a fix, you can match it to a specific CVE ID, watch it flow into the National Vulnerability Database and into your own tooling, and weigh it against everything else on one scale rather than parsing a vendor's prose. That is the whole point of the program, and it is now something we do directly for our products.
We already publish our advisories openly, with no login and no registration, at redeyesecurity.com/security/advisories, and we run a coordinated-disclosure policy with a safe harbor for good-faith research. Being a CNA closes the loop: the advisory and the CVE Record are published together, and the reference you use internally is the same one the rest of the industry uses.
The CVE Program is sponsored by the Cybersecurity and Infrastructure Security Agency (CISA), of the U.S. Department of Homeland Security, and is operated by the MITRE Corporation in collaboration with international industry, academic, and government stakeholders. Authorization as a CNA is a role within that program; it is not an endorsement of RedEye or its products by any of those bodies.
Read the disclosure policy.
Scope, safe harbor for good-faith research, coordinated-disclosure timelines, and how we assign CVE IDs for our products, all on one page.
RedEye Vulnerability Disclosure Policy