A CVE record has one required CNA container, written by the organization that assigned the ID, and optional ADP containers, short for additional data provider, where other organizations add information. That is why the same CVE can show a vendor's score in one place and a different organization's rating in another.
The container model
The CVE Record Format keeps vulnerability information in containers, one per source. The schema marks the CNA container as required. It marks ADP containers as optional, and describes them as a way for additional organizations to add information.
The CNA container of a published record must include provider metadata, descriptions, affected products and references. The ADP container can carry things the CNA left out, such as severity metrics, weakness classification or extra references.
Why this matters when numbers disagree
| You see | Likely reason |
|---|---|
| Two different severity scores for one CVE | One from the CNA container, one from an ADP |
| A weakness type missing in the vendor record but present elsewhere | An ADP added it |
| An extra reference you did not publish | An ADP container added it |
When you read a record, check which container each field came from. The provider metadata tells you who wrote it.
What the tags say about ADP
The ADP tag list in the schema repository includes the disputed tag, defined as used when a party contests another party's claim that an issue is a vulnerability. So an additional data provider can flag a dispute even if the assigning CNA did not.
If you are the CNA or vendor
- Fill the optional fields in your own container yourself, especially metrics, weakness type and workarounds. Otherwise others will fill them in, and their view may differ from yours.
- Keep your container consistent with your advisory.
- If an additional provider publishes a conflicting score, ask how they derived it. Context such as deployment assumptions often explains the gap.
- Do not edit your advisory silently to match. Add a dated change note.
If you are a consumer
Decide in advance which source you trust for which field, and write it into your triage process. For example: use the vendor's affected versions, and use your own environment to adjust severity. That avoids arguments each time a new score appears. Our post on reading severity for incoming reports discusses why scores are inputs, not decisions.
Try it yourself
Click through it at your own pace, or open it full screen.
See how a generic score changes once you ask whether the flaw is actually exploitable in your setup.
Quick check
Is the ADP container required?
No. It is optional. The CNA container is the required one.
Why do two sources give different scores for one CVE?
Different containers can carry different metrics, written by different organizations with different assumptions.
Safeguard's reachability analysis and exploitability checks add your own context to published scores. A free scan shows how.
Sources
Last reviewed: 19 October 2026.
