CVEs begin when a security researcher discloses a vulnerability to a CVE Numbering Authority (CNA). The CNA – initially MITRE ...