CVE assignment

The Drupal project is a CVE Numbering Authority (CNA). A Common Vulnerabilities and Exposures Identifier (CVE ID, or CVE) will be assigned for Drupal core and contributed projects that generally qualify for a Security Advisory and have over 10,000 reported installs.

CVE IDs may also be issued in other cases that match the CNA scope on a reasonable effort basis. Writing CVEs is coordinated in the issue queue of the securitydrupalorg project. People interested in seeing CVEs issued in a timely manner for all advisories should help writing and reviewing the CVE details.