CVE was built to track code flaws with fixes. It’s now being stretched to cover malware and supply chain incidents that don’t ...