Security slang and NVD prose rarely share a word. "sqli" found 843 CVEs
where "sql injection" found 12,719, "lpe" 80 against 1,311 for "privilege
escalation". A term now expands to its phrases and an entry matches on any
of them, with the best-scoring form counted.
A vulnerability searched by the name it is known by leads with the record
it belongs to, whatever the prose and the repository names say: ghostcat
put a different record first, moveit a newer one. Forty names are mapped.
A term with no word in the index at all is nearly always a typo. The
closest word one edit away stands in, weighed by how many records use it,
and the status line says which: citrx finds citrix, fortinte fortinet,
l0g4j log4j.
CVE pages carry BreadcrumbList markup for the home, year and block trail,
and the site publishes an OpenSearch descriptor so a browser can add it
as a search engine from the address bar.
A CVE List V5 record names what it is about: a title such as "PAN-OS:
Arbitrary File Creation Leads to OS Command Injection Vulnerability in
GlobalProtect", a vendor and its products. None of it was kept, so a query
for pan-os or prisma access only found records whose prose happened to say
so. Every record now opens with the title in bold and a Vendor badge per
affected vendor, refreshed from a local CVE List checkout in one pass and
kept current by the daily sync for the records it fetches. Only the lines
above the description move; descriptions and PoC sections are untouched.
The pass also settled the heading link on cve.org and trimmed the stray
space some version badges carried.
The site index carries title, vendor and product for the 40 percent of
indexed CVEs whose records have them. Search scores a hit in those above
any position in the description, results show the title as a headline,
and each page puts it under the CVE id, in the browser title, the meta
description and an Affected row, with the block hubs listing it in place
of the description's opening.
The 35 MB metadata file the homepage needed before anything could be
filtered is split in two for the page: the CVSS rows load with the rest,
the advisories follow the index instead of competing with it for the
connection. cve_metadata.json stays whole for anyone reading the API.
A sitemap gets a page discovered; a link from a page already indexed gets
it crawled and ranked. 62,000 of the CVE pages had no internal link at
all, only a sitemap entry, since the Related block only exists where two
CVEs share a PoC author. The tree is now home, year, block, CVE: one page
per year listing its thousand-id blocks, one page per block listing every
CVE in it with its PoC count and known-exploited mark, crumbs above every
CVE title pointing back up, and a year row on the homepage. No page
carries more than a thousand links. The hubs get their own sitemap shard,
dated from the newest page they contain.
Every keystroke scanned 28 MB of description text, and for terms of four
characters or more the loose regex then ran against every entry that did
not match, about 80,000 regex tests a keystroke: 100 to 230 ms on a
desktop, several times that on a phone. The index now maps each word to
the entries carrying it, built in slices after the data lands so typing
never waits on it, and a term is a prefix lookup plus a scan of the
candidates alone: 7 to 40 ms measured on the same queries. The loose form
of a term, "log-4j" for log4j, is only found by the full pass, which now
runs when the indexed pass comes back nearly empty and not otherwise. The
severity and source of an entry are cached as well, so a filter pass over
the whole index takes 20 ms instead of half a second.
Within a score tier the order fell straight through to the year, which put
five 2026 records above regreSSHion for "openssh" and kept Log4Shell off
the first page of "log4j". Ties now go to the evidence first: CISA's
listing, how many PoCs exist, how likely exploitation is, and only then
the year. A switch on the results panel offers newest and most PoCs
instead, and rides in the URL like the query and the filters. The title,
vendor and product of a record score above its prose once the records
carry them.
CVE-BOT