{"generated":"2026-08-14","dictionary":"2026-08-13","about":"CPE (Common Platform Enumeration) identifiers for endoflife.ai products. CPE is the standard product naming scheme used by vulnerability scanners and CVE records; these mappings let lifecycle data be joined automatically to what a scanner reports. Every identifier was verified to exist and to be non-deprecated in the official NIST CPE dictionary. Products with cpe:null have no identifier that represents them — recorded deliberately rather than approximated.","counts":{"verified":117,"auto":261,"unmapped":126,"undecided":0},"products":{"adonisjs":{"cpe":["cpe:2.3:a:adonisjs:core"],"source":"verified","basis":"230 entries, title 'AdonisJS Core 7.3.0'. The matcher had chosen a:adonisjs:bodyparser, a single middleware package. Verified against the full NIST dictionary 2026-08-13."},"akeneo-pim":{"cpe":["cpe:2.3:a:akeneo:product_information_management"],"source":"verified","basis":"PIM expanded to Product Information Management in the dictionary. Verified 2026-08-13."},"alibaba-ack":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"alibaba-dragonwell":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"almalinux":{"cpe":["cpe:2.3:o:almalinux:almalinux"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"alpine-linux":{"cpe":["cpe:2.3:o:alpinelinux:alpine_linux"],"source":"verified","basis":"Vendor alpinelinux (no separator). Verified 2026-08-13."},"amazon-aurora-postgresql":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-cdk":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-corretto":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-documentdb":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-eks":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-elasticache-redis":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-glue":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-linux":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-mq-activemq":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-mq-rabbitmq":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-msk":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-neptune":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-opensearch":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-rds-mariadb":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-rds-mysql":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"amazon-rds-postgresql":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"android":{"cpe":["cpe:2.3:o:google:android"],"source":"verified","basis":"82 entries, title 'Google Android Operating System 4.4.3'. The top-scoring candidate was o:samsung:android — a vendor build, not the OS. Verified 2026-08-13."},"angular":{"cpe":["cpe:2.3:a:angular:angular"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"angularjs":{"cpe":["cpe:2.3:a:angularjs:angularjs"],"source":"verified","basis":"832 entries, titles at 1.x confirming AngularJS. a:angularjs:angular.js (209) is a NIST duplicate of the same product. Verified 2026-08-13."},"ansible":{"cpe":["cpe:2.3:a:redhat:ansible"],"source":"verified","basis":"Red Hat owns Ansible; runner-up a:jenkins:ansible is the Jenkins plugin. Verified 2026-08-13."},"ansible-core":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:api-platform:core, noise on the word 'core'. ansible-core is not separated from a:redhat:ansible, which is mapped as our ansible product. Verified against the full NIST dictionary 2026-08-13."},"ant":{"cpe":["cpe:2.3:a:apache:ant"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"antix":{"cpe":["cpe:2.3:o:antixlinux:antix_linux"],"source":"verified","basis":"17 entries. Scored 29.7 — below the original NONE floor, which is why that floor was removed rather than left to silently drop findable products. Verified 2026-08-13."},"apache-activemq":{"cpe":["cpe:2.3:a:apache:activemq"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-airflow":{"cpe":["cpe:2.3:a:apache:airflow"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-apisix":{"cpe":["cpe:2.3:a:apache:apisix"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-artemis":{"cpe":["cpe:2.3:a:apache:artemis"],"source":"verified","basis":"Distinct from a:apache:activemq. The matcher's coverage gate held this because our display name 'Apache ActiveMQ Artemis' contains 'activemq'. Verified 2026-08-13."},"apache-camel":{"cpe":["cpe:2.3:a:apache:camel"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-cassandra":{"cpe":["cpe:2.3:a:apache:cassandra"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-commons":{"cpe":null,"unmapped":true,"source":"verified","reason":"Apache Commons is a family of independent libraries, each with its own triple (commons_configuration, commons_lang, commons_io). No triple represents the family. Verified against the full NIST dictionary 2026-08-13."},"apache-couchdb":{"cpe":["cpe:2.3:a:apache:couchdb"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-flink":{"cpe":["cpe:2.3:a:apache:flink"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-groovy":{"cpe":["cpe:2.3:a:apache:groovy"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-hadoop":{"cpe":["cpe:2.3:a:apache:hadoop"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-hop":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:chorny:apache\\, noise. Apache Hop has no triple. Verified against the full NIST dictionary 2026-08-13."},"apache-http-server":{"cpe":["cpe:2.3:a:apache:http_server"],"source":"auto","basis":"Matched against the NIST dictionary; vendor-confirmed+covers-distinctive."},"apache-kafka":{"cpe":["cpe:2.3:a:apache:kafka"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-lucene":{"cpe":["cpe:2.3:a:apache:lucene"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-maven":{"cpe":["cpe:2.3:a:apache:maven"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-nifi":{"cpe":["cpe:2.3:a:apache:nifi"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-pulsar":{"cpe":["cpe:2.3:a:apache:pulsar"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-spark":{"cpe":["cpe:2.3:a:apache:spark"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-struts":{"cpe":["cpe:2.3:a:apache:struts"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-subversion":{"cpe":["cpe:2.3:a:apache:subversion"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"apache-tapestry":{"cpe":["cpe:2.3:a:apache:tapestry"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"api-platform":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:orchid:platform, noise. API Platform (the PHP framework) has no triple. Verified against the full NIST dictionary 2026-08-13."},"apple-watch":{"cpe":null,"unmapped":true,"source":"verified","reason":"Only h:apple:watch_ultra and watch_ultra_2 exist as hardware, one model each. o:apple:watchos is the OS and is tracked separately as our watchos product. Verified against the full NIST dictionary 2026-08-13."},"arangodb":{"cpe":["cpe:2.3:a:arangodb:arangodb"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"argo-cd":{"cpe":["cpe:2.3:a:argoproj:argo_cd"],"source":"verified","basis":"Vendor argoproj. Verified 2026-08-13."},"argo-workflows":{"cpe":["cpe:2.3:a:argoproj:argo_workflows"],"source":"verified","basis":"324 entries, 0% deprecated. Superseded: the previously chosen triple was 100% deprecated in NIST's dictionary. Deprecated names are not what scanners emit. Verified 2026-08-13."},"artifactory":{"cpe":["cpe:2.3:a:jfrog:artifactory"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"atlassian-data-center":{"cpe":["cpe:2.3:a:atlassian:confluence_data_center"],"source":"auto","basis":"Matched against the NIST dictionary; vendor-confirmed+covers-distinctive."},"authentik":{"cpe":["cpe:2.3:a:goauthentik:authentik"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"aws-lambda":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"azul-zulu":{"cpe":["cpe:2.3:a:azul:zulu"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"azure-database-for-mysql":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"azure-database-for-postgresql":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"azure-devops-server":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"azure-kubernetes-service":{"cpe":null,"unmapped":true,"source":"policy","reason":"Managed cloud service — nothing runs on a host for a scanner to detect, so no CPE applies."},"backdrop":{"cpe":["cpe:2.3:a:backdropcms:backdrop"],"source":"verified","basis":"Vendor is backdropcms; our slug omits the CMS suffix. Verified 2026-08-13."},"bamboo":{"cpe":["cpe:2.3:a:atlassian:bamboo"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"bazel":{"cpe":["cpe:2.3:a:google:bazel"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"beats":{"cpe":["cpe:2.3:a:elastic:elastic_beats"],"source":"verified","basis":"2 entries, title 'Elastic Beats 8.0.0'. Small but exact; the only rival is Apple Beats headphone firmware. Verified against the full NIST dictionary 2026-08-13."},"behat":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"bellsoft-liberica":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"big-ip":{"cpe":null,"unmapped":true,"source":"verified","reason":"The dictionary splits BIG-IP into modules (big-ip_local_traffic_manager, big-ip_application_security_manager, big-ip_access_policy_manager and others, ~270 entries each). No triple represents the BIG-IP platform whose lifecycle we track. Verified against the full NIST dictionary 2026-08-13."},"bigbluebutton":{"cpe":["cpe:2.3:a:bigbluebutton:bigbluebutton"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"bitbucket":{"cpe":["cpe:2.3:a:atlassian:bitbucket"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"bitcoin-core":{"cpe":["cpe:2.3:a:bitcoin:bitcoin_core"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"blender":{"cpe":["cpe:2.3:a:blender:blender"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"bootstrap":{"cpe":["cpe:2.3:a:getbootstrap:bootstrap"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"boundary":{"cpe":["cpe:2.3:a:hashicorp:boundary"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"bun":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"cachet":{"cpe":["cpe:2.3:a:all-three:cachet"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"caddy":{"cpe":["cpe:2.3:a:caddy_project:caddy"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"cakephp":{"cpe":["cpe:2.3:a:cakephp:cakephp"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"calico":{"cpe":["cpe:2.3:a:tigera:calico"],"source":"verified","basis":"Top candidate, score 81; 366 dictionary entries; product name appears in the dictionary title ['Tigera Calico 17.1.1 Cloud Edition']. Batch-verified by title corroboration 2026-08-13."},"cdh":{"cpe":["cpe:2.3:a:cloudera:cdh"],"source":"verified","basis":"86 entries, title 'Cloudera CDH'. Verified against the full NIST dictionary 2026-08-13."},"centos":{"cpe":["cpe:2.3:o:centos:centos"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"centos-stream":{"cpe":["cpe:2.3:o:centos:stream"],"source":"verified","basis":"Distinct from o:centos:centos (CentOS Linux). Note the dictionary names it 'stream', not 'centos_stream'. Verified 2026-08-13."},"centreon":{"cpe":["cpe:2.3:a:centreon:centreon"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"cert-manager":{"cpe":["cpe:2.3:a:linuxfoundation:cert-manager"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"cfengine":{"cpe":["cpe:2.3:a:northern.tech:cfengine"],"source":"verified","basis":"Top candidate, score 80; 46 dictionary entries; product name appears in the dictionary title ['Northern.tech Cfengine 3.6.0 Enterprise Edition']. Batch-verified by title corroboration 2026-08-13."},"checkmk":{"cpe":["cpe:2.3:a:checkmk:checkmk"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"chef-infra-client":{"cpe":null,"unmapped":true,"source":"verified","reason":"a:chef:chef (2278 entries) is Chef generally, not the Infra Client specifically; no infra_client triple exists. Mapping the client to the umbrella entry would misattribute every Chef CVE to it. Verified against the full NIST dictionary 2026-08-13."},"chef-infra-server":{"cpe":["cpe:2.3:a:progress:chef_infra_server"],"source":"verified","basis":"Top candidate, score 81; 1555 dictionary entries; product name appears in the dictionary title ['Progress Chef Infra Server 15.7.3']. Batch-verified by title corroboration 2026-08-13."},"chef-inspec":{"cpe":["cpe:2.3:a:chef:inspec"],"source":"verified","basis":"Distinct from a:chef:chef. Verified 2026-08-13."},"chef-supermarket":{"cpe":null,"unmapped":true,"source":"verified","reason":"No Supermarket triple exists; the matcher fell back to the umbrella a:chef:chef. Verified against the full NIST dictionary 2026-08-13."},"chef-workstation":{"cpe":null,"unmapped":true,"source":"verified","reason":"No a:chef:workstation triple exists; the matcher fell back to the umbrella a:chef:chef. Verified against the full NIST dictionary 2026-08-13."},"chrome":{"cpe":["cpe:2.3:a:google:chrome"],"source":"verified","basis":"The browser. o:google:chrome is Chrome OS — a different product tracked separately. Verified 2026-08-13."},"cilium":{"cpe":["cpe:2.3:a:cilium:cilium"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"cisco-ios-xe":{"cpe":["cpe:2.3:o:cisco:ios_xe"],"source":"verified","basis":"Distinct from o:cisco:ios. Verified 2026-08-13."},"citrix-vad":{"cpe":["cpe:2.3:a:citrix:virtual_apps_and_desktops"],"source":"verified","basis":"Our slug is the acronym VAD; the dictionary spells it out. Verified 2026-08-13."},"ckeditor":{"cpe":["cpe:2.3:a:ckeditor:ckeditor"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"clamav":{"cpe":["cpe:2.3:a:clamav:clamav"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"claude":{"cpe":null,"unmapped":true,"source":"verified","reason":"Our product tracks Anthropic's models (claude-opus-5). The dictionary's Anthropic entries are tooling: claude_code (CLI) and the language SDKs. No model entry exists. Verified against the full NIST dictionary 2026-08-13."},"clear-linux":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was o:oracle:linux. Clear Linux has no triple of its own. Verified against the full NIST dictionary 2026-08-13."},"clickhouse":{"cpe":["cpe:2.3:a:clickhouse:clickhouse"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"cloud-sql-auth-proxy":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:proxy_project:proxy, noise. Google's Cloud SQL Auth Proxy has no triple. Verified against the full NIST dictionary 2026-08-13."},"cloudera-base":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:abb:base_software, noise. Verified against the full NIST dictionary 2026-08-13."},"cloudera-data-flow":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:flow_project:flow, noise. Verified against the full NIST dictionary 2026-08-13."},"cloudera-data-services":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:services_project:services, noise. Verified against the full NIST dictionary 2026-08-13."},"cloudera-on-cloud":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:vmware:cloud_foundation, noise. Verified against the full NIST dictionary 2026-08-13."},"cloudera-platform":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:orchid:platform, noise. Verified against the full NIST dictionary 2026-08-13."},"cnspec":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"cockroachdb":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"coder":{"cpe":["cpe:2.3:a:coder:coder"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"coldfusion":{"cpe":["cpe:2.3:a:adobe:coldfusion"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"cometd":{"cpe":["cpe:2.3:a:cometd:cometd"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"commvault":{"cpe":["cpe:2.3:a:commvault:commvault"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"composer":{"cpe":["cpe:2.3:a:getcomposer:composer"],"source":"verified","basis":"Top candidate, score 81; 221 dictionary entries; product name appears in the dictionary title ['Getcomposer Composer 1.10.27']. Batch-verified by title corroboration 2026-08-13."},"concrete-cms":{"cpe":["cpe:2.3:a:concretecms:concrete_cms"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"confluence":{"cpe":["cpe:2.3:a:atlassian:confluence_data_center","cpe:2.3:a:atlassian:confluence_server"],"source":"verified","basis":"Two live entries: confluence_data_center (566, 0% dep) and confluence_server (501, 0% dep). Both are mapped because our lifecycle data covers both editions. Plain a:atlassian:confluence is 100% deprecated, and the matcher had picked a:mattermost:confluence — a Mattermost plugin, not Atlassian's product. Verified 2026-08-13."},"consul":{"cpe":["cpe:2.3:a:hashicorp:consul"],"source":"verified","basis":"Top candidate, score 81; 580 dictionary entries; product name appears in the dictionary title ['Hashicorp Consul 1.14.7 - Edition']. Batch-verified by title corroboration 2026-08-13."},"containerd":{"cpe":["cpe:2.3:a:linuxfoundation:containerd"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"contao":{"cpe":["cpe:2.3:a:contao:contao"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"contour":{"cpe":["cpe:2.3:a:projectcontour:contour"],"source":"verified","basis":"Top candidate, score 81; 169 dictionary entries; product name appears in the dictionary title ['Projectcontour Contour 2023-10-11 for Kubernetes']. Batch-verified by title corroboration 2026-08-13."},"controlm":{"cpe":["cpe:2.3:a:bmc:control-m"],"source":"verified","basis":"Top candidate, score 79.1; 23 dictionary entries; product name appears in the dictionary title ['BMC Control-M 9.0.20.214']. Batch-verified by title corroboration 2026-08-13."},"cortex-xdr":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:linuxfoundation:cortex, an unrelated project. Palo Alto Cortex XDR has no triple. Verified against the full NIST dictionary 2026-08-13."},"cos":{"cpe":["cpe:2.3:o:google:container-optimized_os"],"source":"verified","basis":"Sole entry, title 'Google Container-Optimized OS'. Verified against the full NIST dictionary 2026-08-13."},"couchbase-server":{"cpe":["cpe:2.3:a:couchbase:couchbase_server"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"craft-cms":{"cpe":["cpe:2.3:a:craftcms:craft_cms"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"dbt-core":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:api-platform:core, noise on 'core'. dbt has no triple. Verified against the full NIST dictionary 2026-08-13."},"dce":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"debian":{"cpe":["cpe:2.3:o:debian:debian_linux"],"source":"verified","basis":"65 entries, title 'Debian Linux'. Verified 2026-08-13."},"deno":{"cpe":["cpe:2.3:a:deno:deno"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"dependency-track":{"cpe":["cpe:2.3:a:owasp:dependency-track"],"source":"verified","basis":"Top candidate, score 80; 47 dictionary entries; product name appears in the dictionary title ['OWASP Dependency-Track -']. Batch-verified by title corroboration 2026-08-13."},"derby":{"cpe":["cpe:2.3:a:apache:derby"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"devuan":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"discourse":{"cpe":["cpe:2.3:a:discourse:discourse"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"django":{"cpe":["cpe:2.3:a:djangoproject:django"],"source":"verified","basis":"444 entries, 0% deprecated; vendor djangoproject, not django_project. Superseded: the previously chosen triple was 100% deprecated in NIST's dictionary. Deprecated names are not what scanners emit. Verified 2026-08-13."},"docker-engine":{"cpe":["cpe:2.3:a:docker:engine"],"source":"verified","basis":"Distinct from a:docker:docker. Verified 2026-08-13."},"dojo":{"cpe":["cpe:2.3:a:linuxfoundation:dojo"],"source":"verified","basis":"236 entries; the Dojo Toolkit is a Linux Foundation project. Verified against the full NIST dictionary 2026-08-13."},"dom4j":{"cpe":["cpe:2.3:a:dom4j_project:dom4j"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"dotnet":{"cpe":["cpe:2.3:a:microsoft:.net"],"source":"verified","basis":"Top candidate, score 81; 196 dictionary entries; product name appears in the dictionary title ['Microsoft .NET 7.0.0']. Batch-verified by title corroboration 2026-08-13."},"dotnetfx":{"cpe":["cpe:2.3:a:microsoft:.net_framework"],"source":"verified","basis":"Top candidate, score 80; 47 dictionary entries; product name appears in the dictionary title ['Microsoft .NET Framework 1.1 2003 sp2']. Batch-verified by title corroboration 2026-08-13."},"dovecot":{"cpe":["cpe:2.3:a:dovecot:dovecot"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"dropwizard":{"cpe":null,"unmapped":true,"source":"verified","reason":"Only a:dropwizard:dropwizard_validation (159 entries), one module. No entry for the Dropwizard framework. Verified against the full NIST dictionary 2026-08-13."},"drupal":{"cpe":["cpe:2.3:a:drupal:drupal"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"drush":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"duckdb":{"cpe":["cpe:2.3:a:duckdb:duckdb"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"eclipse-jetty":{"cpe":["cpe:2.3:a:eclipse:jetty"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"eclipse-temurin":{"cpe":["cpe:2.3:a:eclipse:temurin"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"elasticsearch":{"cpe":["cpe:2.3:a:elasticsearch:elasticsearch"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"electron":{"cpe":["cpe:2.3:a:electronjs:electron"],"source":"verified","basis":"Top candidate, score 81; 2832 dictionary entries; product name appears in the dictionary title ['Electronjs Electron 22.0.0 for Node.js']. Batch-verified by title corroboration 2026-08-13."},"elixir":{"cpe":["cpe:2.3:a:teamworktec:elixir"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"elliptic":{"cpe":["cpe:2.3:a:indutny:elliptic"],"source":"verified","basis":"89 entries, 0% deprecated; vendor is the maintainer (indutny). Superseded: the previously chosen triple was 100% deprecated in NIST's dictionary. Deprecated names are not what scanners emit. Verified 2026-08-13."},"emberjs":{"cpe":["cpe:2.3:a:emberjs:ember.js"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"envoy":{"cpe":["cpe:2.3:a:envoyproxy:envoy"],"source":"verified","basis":"Top candidate, score 81; 277 dictionary entries; product name appears in the dictionary title ['Envoy Proxy Envoy 1.25.4']. Batch-verified by title corroboration 2026-08-13."},"erlang":{"cpe":["cpe:2.3:a:erlang:erlang\\/otp"],"source":"verified","basis":"569 entries, title 'Erlang/OTP'. Rivals under the same vendor (erts, erlang/ssh, erlang/ssl) are components of it. Verified against the full NIST dictionary 2026-08-13."},"eslint":{"cpe":["cpe:2.3:a:openjsf:eslint"],"source":"verified","basis":"Top candidate, score 81; 406 dictionary entries; product name appears in the dictionary title ['OpenJS Foundation ESLint 9.26.0 for Node.js']. Batch-verified by title corroboration 2026-08-13."},"esxi":{"cpe":["cpe:2.3:o:vmware:esxi"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"etcd":{"cpe":["cpe:2.3:a:etcd:etcd"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"eurolinux":{"cpe":["cpe:2.3:o:eurolinux:eurolinux"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"exim":{"cpe":["cpe:2.3:a:exim:exim"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"express":{"cpe":["cpe:2.3:a:openjsf:express"],"source":"verified","basis":"295 entries, 0% deprecated; Express.js is governed by the OpenJS Foundation. The matcher chose a:express:express, a single-entry namesake. Verified 2026-08-13."},"fairphone":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"fastify":{"cpe":["cpe:2.3:a:fastify:fastify"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"fedora":{"cpe":["cpe:2.3:o:fedoraproject:fedora"],"source":"verified","basis":"Top candidate, score 79.7; 37 dictionary entries; product name appears in the dictionary title ['Fedora']. Batch-verified by title corroboration 2026-08-13."},"ffmpeg":{"cpe":["cpe:2.3:a:ffmpeg:ffmpeg"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"filemaker":{"cpe":["cpe:2.3:a:filemaker:filemaker"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"firefox":{"cpe":["cpe:2.3:a:mozilla:firefox"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"fluent-bit":{"cpe":["cpe:2.3:a:treasuredata:fluent_bit"],"source":"verified","basis":"Top candidate, score 81; 241 dictionary entries; product name appears in the dictionary title ['Treasuredata Fluent Bit 1.7.1']. Batch-verified by title corroboration 2026-08-13."},"flux":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:control-plane:flux_operator. Flux CD itself appears as a:fluxcd:flux2, whose name and versioning (flux2) do not correspond to the cycles we track; left unmapped rather than guessed. Verified against the full NIST dictionary 2026-08-13."},"font-awesome":{"cpe":null,"unmapped":true,"source":"verified","reason":"Every candidate is a WordPress plugin, including a:fontawesome:font_awesome whose sole entry is titled 'Font Awesome 4.3.2 for WordPress'. The icon library has no CPE. Verified against the full NIST dictionary 2026-08-13."},"foreman":{"cpe":["cpe:2.3:a:theforeman:foreman"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"forgejo":{"cpe":["cpe:2.3:a:forgejo:forgejo"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"fortios":{"cpe":["cpe:2.3:o:fortinet:fortios"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"freebsd":{"cpe":["cpe:2.3:o:freebsd:freebsd"],"source":"verified","basis":"OS part 'o'; an application-part duplicate also exists. Verified 2026-08-13."},"freedesktop-sdk":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:sun:sdk, noise on 'sdk'. Freedesktop SDK has no triple. Verified against the full NIST dictionary 2026-08-13."},"gatekeeper":{"cpe":["cpe:2.3:a:openpolicyagent:gatekeeper"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"gerrit":{"cpe":["cpe:2.3:a:google:gerrit"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"ghc":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"github-actions-runner-images":{"cpe":null,"unmapped":true,"source":"verified","reason":"a:github:runner is the Actions runner agent; our product tracks the VM images it runs on. Different artifacts with different lifecycles. Verified against the full NIST dictionary 2026-08-13."},"gitlab":{"cpe":["cpe:2.3:a:gitlab:gitlab"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"gitlab-runner":{"cpe":["cpe:2.3:a:gitlab:gitlab_runner"],"source":"verified","basis":"Distinct from a:gitlab:runner. Verified 2026-08-13."},"gleam":{"cpe":["cpe:2.3:a:lpil:gleam"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"go":{"cpe":["cpe:2.3:a:go:go"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"goaccess":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"godot":{"cpe":["cpe:2.3:a:godotengine:godot"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"google-kubernetes-engine":{"cpe":["cpe:2.3:a:google:kubernetes_engine"],"source":"auto","basis":"Matched against the NIST dictionary; vendor-confirmed+covers-distinctive."},"google-nexus":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:project-nexus_project:project-nexus, unrelated. Google Nexus devices have no representative triple. Verified against the full NIST dictionary 2026-08-13."},"gorilla":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"graalvm-ce":{"cpe":null,"unmapped":true,"source":"verified","reason":"a:oracle:graalvm covers GraalVM generally; Community Edition is not separated in the dictionary, and CE and EE have different lifecycles, so the shared identifier would be misleading. Verified against the full NIST dictionary 2026-08-13."},"gradle":{"cpe":["cpe:2.3:a:gradle:gradle"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"grafana":{"cpe":["cpe:2.3:a:grafana:grafana"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"grafana-loki":{"cpe":["cpe:2.3:a:grafana:loki"],"source":"auto","basis":"Matched against the NIST dictionary; same-vendor-more-specific."},"grails":{"cpe":["cpe:2.3:a:grails:grails"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"graphql-java":{"cpe":["cpe:2.3:a:graphql-java:graphql-java"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"graylog":{"cpe":["cpe:2.3:a:graylog:graylog"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"greenlight":{"cpe":["cpe:2.3:a:bigbluebutton:greenlight"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"grumphp":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"grunt":{"cpe":["cpe:2.3:a:gruntjs:grunt"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"gstreamer":{"cpe":["cpe:2.3:a:gstreamer:gstreamer"],"source":"verified","basis":"Top candidate, score 101; 200 dictionary entries; product name appears in the dictionary title ['GStreamer 1.10.1']. Batch-verified by title corroboration 2026-08-13."},"guava":{"cpe":["cpe:2.3:a:google:guava"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"guzzle":{"cpe":["cpe:2.3:a:guzzlephp:guzzle"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"h2":{"cpe":["cpe:2.3:a:h2database:h2"],"source":"verified","basis":"Top candidate, score 81; 123 dictionary entries; product name appears in the dictionary title ['H2 Database H2 1.0']. Batch-verified by title corroboration 2026-08-13."},"haproxy":{"cpe":["cpe:2.3:a:haproxy:haproxy"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"haproxy-ingress":{"cpe":["cpe:2.3:a:haproxy:haproxy"],"source":"verified","basis":"543 entries. The HAProxy Ingress Controller has no entry of its own; it ships and versions HAProxy itself, so the engine is the defensible identifier. Verified against the full NIST dictionary 2026-08-13."},"harbor":{"cpe":["cpe:2.3:a:linuxfoundation:harbor"],"source":"verified","basis":"Top candidate, score 81; 339 dictionary entries; product name appears in the dictionary title ['Linux Foundation Harbor 2.6.0']. Batch-verified by title corroboration 2026-08-13."},"hashicorp-packer":{"cpe":["cpe:2.3:a:hashicorp:packer"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"hashicorp-vault":{"cpe":["cpe:2.3:a:hashicorp:vault"],"source":"auto","basis":"Matched against the NIST dictionary; vendor-confirmed+covers-distinctive."},"hazelcast":{"cpe":["cpe:2.3:a:hazelcast:hazelcast"],"source":"verified","basis":"335 entries, exact vendor and product. Verified against the full NIST dictionary 2026-08-13."},"hbase":{"cpe":["cpe:2.3:a:apache:hbase"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"hdp":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:orchid:platform, noise. Hortonworks Data Platform has no triple. Verified against the full NIST dictionary 2026-08-13."},"hibernate-orm":{"cpe":["cpe:2.3:a:hibernate:hibernate_orm"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"horizon":{"cpe":["cpe:2.3:a:vmware:horizon"],"source":"verified","basis":"122 entries, title 'VMware Horizon 6.1.0'. Matcher chose a:horizon_project:horizon; the dictionary also holds OpenNMS Horizon and OpenStack Horizon, which are unrelated products of the same name. Omnissa (the post-spinout vendor) has no horizon entry yet. Verified 2026-08-13."},"ibm-aix":{"cpe":["cpe:2.3:o:ibm:aix"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"ibm-db2":{"cpe":["cpe:2.3:a:ibm:db2"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"ibm-i":{"cpe":["cpe:2.3:o:ibm:i"],"source":"auto","basis":"Matched against the NIST dictionary; vendor-confirmed+covers-distinctive."},"ibm-mq":{"cpe":["cpe:2.3:a:ibm:mq"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"ibm-semeru-runtime":{"cpe":["cpe:2.3:a:ibm:semeru_runtime"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"icinga":{"cpe":["cpe:2.3:a:icinga:icinga"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"icinga-web":{"cpe":["cpe:2.3:a:icinga:icinga_web_2"],"source":"verified","basis":"44 entries, title 'Icinga Web 2' — the product we track, distinct from a:icinga:icinga (the core). Verified against the full NIST dictionary 2026-08-13."},"idl":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"influxdb":{"cpe":["cpe:2.3:a:influxdata:influxdb"],"source":"verified","basis":"Top candidate, score 81; 170 dictionary entries; product name appears in the dictionary title ['Influxdata InfluxDB']. Batch-verified by title corroboration 2026-08-13."},"ingress-nginx":{"cpe":["cpe:2.3:a:kubernetes:ingress-nginx"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"intel-processors":{"cpe":null,"unmapped":true,"source":"verified","reason":"Only specific families exist (h:intel:core_i7, core_i5, xeon_e5). Our cycles are CPU generations (panther-lake); no triple represents the processor line. Verified against the full NIST dictionary 2026-08-13."},"internet-explorer":{"cpe":["cpe:2.3:a:microsoft:internet_explorer"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"ionic":{"cpe":null,"unmapped":true,"source":"verified","reason":"Only a:ionic:identity_vault (42 entries), a separate commercial product. The Ionic Framework has no entry. Verified against the full NIST dictionary 2026-08-13."},"ios":{"cpe":["cpe:2.3:o:apple:iphone_os"],"source":"verified","basis":"331 entries, title 'Apple iPhone OS 2.1'. Our display name 'iOS' keyword-searches to Cisco IOS only — Apple's entry never appears. Verified 2026-08-13."},"ipad":{"cpe":["cpe:2.3:h:apple:ipad"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"ipados":{"cpe":["cpe:2.3:o:apple:ipados"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"iphone":{"cpe":null,"unmapped":true,"source":"verified","reason":"Our product tracks iPhone hardware models. h:apple:iphone is 100% deprecated and the rest are individual handsets. o:apple:iphone_os is the OS and is already mapped as our ios product. Verified against the full NIST dictionary 2026-08-13."},"isc-dhcp":{"cpe":["cpe:2.3:a:isc:dhcp"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"istio":{"cpe":["cpe:2.3:a:istio:istio"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"jackson":{"cpe":["cpe:2.3:a:fasterxml:jackson"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"jaeger":{"cpe":["cpe:2.3:a:linuxfoundation:jaeger"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"jekyll":{"cpe":["cpe:2.3:a:jekyllrb:jekyll"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"jenkins":{"cpe":["cpe:2.3:a:jenkins:jenkins"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"jhipster":{"cpe":["cpe:2.3:a:jhipster:jhipster"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"jira-software":{"cpe":["cpe:2.3:a:atlassian:jira_data_center","cpe:2.3:a:atlassian:jira_server"],"source":"verified","basis":"Two live entries, jira_data_center (335, 0% dep) and jira_server (309, 0% dep), covering the two deployment editions our single lifecycle covers. Bare a:atlassian:jira is 39% deprecated and jira_software_data_center is 100% deprecated. Same treatment as confluence. Verified against the full NIST dictionary 2026-08-13."},"joomla":{"cpe":["cpe:2.3:a:joomla:joomla\\!"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"jquery":{"cpe":["cpe:2.3:a:jquery:jquery"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"jquery-ui":{"cpe":["cpe:2.3:a:jqueryui:jquery_ui"],"source":"verified","basis":"95 entries, 0% deprecated. The near-identical a:jquery:jquery_ui (93 entries) is 100% deprecated. Verified against the full NIST dictionary 2026-08-13."},"jreleaser":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"jruby":{"cpe":["cpe:2.3:a:jruby:jruby"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"json-java":{"cpe":["cpe:2.3:a:stleary:json-java"],"source":"verified","basis":"25 entries; stleary is the maintainer of org.json. Verified against the full NIST dictionary 2026-08-13."},"jsonpath":{"cpe":["cpe:2.3:a:dchester:jsonpath"],"source":"verified","basis":"29 entries; dchester is the package maintainer. Verified against the full NIST dictionary 2026-08-13."},"julia":{"cpe":["cpe:2.3:a:julialang:julia"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"karpenter":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"kde-plasma":{"cpe":["cpe:2.3:a:kde:plasma"],"source":"auto","basis":"Matched against the NIST dictionary; vendor-confirmed+covers-distinctive."},"keda":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"keycloak":{"cpe":["cpe:2.3:a:redhat:keycloak"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"kibana":{"cpe":["cpe:2.3:a:elastic:kibana"],"source":"verified","basis":"Top candidate, score 81; 556 dictionary entries; product name appears in the dictionary title ['Elastic Kibana 7.17.9']. Batch-verified by title corroboration 2026-08-13."},"kindle":{"cpe":["cpe:2.3:h:amazon:kindle"],"source":"verified","basis":"The e-reader device, title 'Amazon Kindle e-Reader'. a:amazon:kindle is the Kindle reading APP for Android — a different product. Verified 2026-08-13."},"kirby":{"cpe":["cpe:2.3:a:getkirby:kirby"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"knative":{"cpe":null,"unmapped":true,"source":"verified","reason":"Only a:knative:serving exists under the Knative vendor — one component. There is no entry for Knative as a platform, and none for Eventing. Verified against the full NIST dictionary 2026-08-13."},"knockout":{"cpe":["cpe:2.3:a:knockoutjs:knockout"],"source":"verified","basis":"45 entries, vendor knockoutjs. Verified against the full NIST dictionary 2026-08-13."},"kong-gateway":{"cpe":["cpe:2.3:a:konghq:kong_gateway"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"kotlin":{"cpe":["cpe:2.3:a:jetbrains:kotlin"],"source":"verified","basis":"Top candidate, score 81; 1895 dictionary entries; product name appears in the dictionary title ['JetBrains Kotlin 1.6.0 ']. Batch-verified by title corroboration 2026-08-13."},"kubernetes":{"cpe":["cpe:2.3:a:kubernetes:kubernetes"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"kubernetes-csi-node-driver-registrar":{"cpe":null,"unmapped":true,"source":"verified","reason":"No triple for this sub-project; same umbrella fallback problem. Verified against the full NIST dictionary 2026-08-13."},"kubernetes-node-feature-discovery":{"cpe":null,"unmapped":true,"source":"verified","reason":"No triple for this sub-project; the matcher fell back to a:kubernetes:kubernetes, which would attribute all Kubernetes CVEs to an add-on. Verified against the full NIST dictionary 2026-08-13."},"kuma":{"cpe":null,"unmapped":true,"source":"verified","reason":"Our product is Kong's Kuma service mesh. The dictionary has Uptime Kuma (an unrelated monitoring tool) and Kong Gateway, but no Kong Kuma. Verified against the full NIST dictionary 2026-08-13."},"kyverno":{"cpe":["cpe:2.3:a:kyverno:kyverno"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"laravel":{"cpe":["cpe:2.3:a:laravel:laravel"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"ldap-account-manager":{"cpe":["cpe:2.3:a:ldap-account-manager:ldap_account_manager"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"libreoffice":{"cpe":["cpe:2.3:a:libreoffice:libreoffice"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"lineageos":{"cpe":["cpe:2.3:o:lineageos:lineageos"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"linux":{"cpe":["cpe:2.3:o:oracle:linux"],"source":"verified","basis":"Top candidate, score 80.3; 57 dictionary entries; product name appears in the dictionary title ['Oracle Linux 6.0']. Batch-verified by title corroboration 2026-08-13."},"linuxmint":{"cpe":["cpe:2.3:o:linuxmint:linux_mint"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"liquibase":{"cpe":["cpe:2.3:a:liquibase:liquibase"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"lodash":{"cpe":["cpe:2.3:a:lodash:lodash"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"log4j":{"cpe":["cpe:2.3:a:apache:log4j"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"logstash":{"cpe":["cpe:2.3:a:elastic:logstash"],"source":"verified","basis":"Top candidate, score 81; 417 dictionary entries; product name appears in the dictionary title ['Elastic Logstash 8.10.0']. Batch-verified by title corroboration 2026-08-13."},"longhorn":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"looker":{"cpe":["cpe:2.3:a:google:looker"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"loopback":{"cpe":["cpe:2.3:a:ibm:loopback"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"lua":{"cpe":["cpe:2.3:a:lua:lua"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"macos":{"cpe":["cpe:2.3:o:apple:macos"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"mageia":{"cpe":["cpe:2.3:o:mageia:mageia"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"magento":{"cpe":["cpe:2.3:a:magento:magento"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"mandrel":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"mariadb":{"cpe":["cpe:2.3:a:mariadb:mariadb"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"mastodon":{"cpe":["cpe:2.3:a:joinmastodon:mastodon"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"matomo":{"cpe":["cpe:2.3:a:matomo:matomo"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"mattermost":{"cpe":["cpe:2.3:a:mattermost:mattermost"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"mautic":{"cpe":["cpe:2.3:a:acquia:mautic"],"source":"verified","basis":"209 entries, 8% deprecated; Acquia acquired Mautic. Superseded: the previously chosen triple was 100% deprecated in NIST's dictionary. Deprecated names are not what scanners emit. Verified 2026-08-13."},"mediawiki":{"cpe":["cpe:2.3:a:mediawiki:mediawiki"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"meilisearch":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"memcached":{"cpe":["cpe:2.3:a:memcached:memcached"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"metallb":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"micronaut":{"cpe":["cpe:2.3:a:objectcomputing:micronaut"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"microsoft-build-of-openjdk":{"cpe":null,"unmapped":true,"source":"verified","reason":"Only a:oracle:openjdk exists, which is specifically Oracle's build. No Microsoft build triple exists, and attributing Oracle's identifier to Microsoft's distribution would be wrong. Verified against the full NIST dictionary 2026-08-13."},"moment":{"cpe":["cpe:2.3:a:momentjs:moment"],"source":"verified","basis":"Top candidate, score 80.8; 89 dictionary entries; product name appears in the dictionary title ['Moment.js Moment 0.3.0 for Node.js']. Batch-verified by title corroboration 2026-08-13."},"mongodb":{"cpe":["cpe:2.3:a:mongodb:mongodb"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"moodle":{"cpe":["cpe:2.3:a:moodle:moodle"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"motorola-mobility":{"cpe":null,"unmapped":true,"source":"verified","reason":"Only a:motorola:motorola_scanner_sdk exists, an unrelated product. Verified against the full NIST dictionary 2026-08-13."},"msexchange":{"cpe":["cpe:2.3:a:microsoft:exchange_server"],"source":"verified","basis":"143 entries, 6% deprecated, title 'Microsoft Exchange Server' — the official name for what we list as Microsoft Exchange. Verified against the full NIST dictionary 2026-08-13."},"mssqlserver":{"cpe":["cpe:2.3:a:microsoft:sql_server"],"source":"verified","basis":"Top candidate, score 81; 100 dictionary entries; product name appears in the dictionary title ['Microsoft SQLServer']. Batch-verified by title corroboration 2026-08-13."},"mulesoft-runtime":{"cpe":["cpe:2.3:a:mulesoft:mule_runtime"],"source":"verified","basis":"60 entries, title 'MuleSoft Mule Runtime'. a:mulesoft:aplkit has more entries but is APIKit, a different product. Verified against the full NIST dictionary 2026-08-13."},"mxlinux":{"cpe":["cpe:2.3:o:mxlinux:mx_linux"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"mysql":{"cpe":["cpe:2.3:a:oracle:mysql"],"source":"verified","basis":"776 entries, title 'Oracle MySQL 5.5.40' — the primary post-acquisition entry. a:mysql:mysql (415) is the legacy pre-Oracle namespace; a:mysql_project:mysql (69) is unrelated. Verified 2026-08-13."},"mysql-connector-j":{"cpe":["cpe:2.3:a:oracle:mysql_connector\\/j"],"source":"auto","basis":"Matched against the NIST dictionary; same-vendor-more-specific."},"neo4j":{"cpe":["cpe:2.3:a:neo4j:neo4j"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"neos":{"cpe":["cpe:2.3:a:typo3:neos"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"nestjs":{"cpe":["cpe:2.3:a:nestjs:nest"],"source":"verified","basis":"382 entries, vendor nestjs, title 'NestJS Nest 9.0.5 for Node.js'. Verified against the full NIST dictionary 2026-08-13."},"netapp-ontap":{"cpe":["cpe:2.3:a:netapp:ontap"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"netbackup-appliance-os":{"cpe":["cpe:2.3:a:veritas:netbackup_appliance"],"source":"verified","basis":"28 entries, exact product. Verified against the full NIST dictionary 2026-08-13."},"netbsd":{"cpe":["cpe:2.3:o:netbsd:netbsd"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"nextcloud":{"cpe":["cpe:2.3:a:nextcloud:nextcloud"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"nextjs":{"cpe":["cpe:2.3:a:vercel:next.js"],"source":"verified","basis":"Top candidate, score 81; 3723 dictionary entries; product name appears in the dictionary title ['Vercel Next.js 11.1.4 for Node.js']. Batch-verified by title corroboration 2026-08-13."},"nexus":{"cpe":["cpe:2.3:a:sonatype:nexus"],"source":"verified","basis":"Top candidate, score 80.2; 56 dictionary entries; product name appears in the dictionary title ['Sonatype Nexus Open Source 2.11.0']. Batch-verified by title corroboration 2026-08-13."},"nginx":{"cpe":["cpe:2.3:a:f5:nginx"],"source":"verified","basis":"582 entries, 0% deprecated; F5 acquired NGINX. Superseded: the previously chosen triple was 100% deprecated in NIST's dictionary. Deprecated names are not what scanners emit. Verified 2026-08-13."},"nix":{"cpe":["cpe:2.3:a:nix_project:nix"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"nixos":{"cpe":["cpe:2.3:o:nixos:nixos"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"nodejs":{"cpe":["cpe:2.3:a:nodejs:node.js"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"nokia":{"cpe":null,"unmapped":true,"source":"verified","reason":"Our product tracks Nokia handsets. The dictionary's Nokia entries are enterprise products (1350 Optical Management System, Qt Creator, Affix). Verified against the full NIST dictionary 2026-08-13."},"nomad":{"cpe":["cpe:2.3:a:hashicorp:nomad"],"source":"verified","basis":"Top candidate, score 81; 314 dictionary entries; product name appears in the dictionary title ['HashiCorp Nomad 1.2.15']. Batch-verified by title corroboration 2026-08-13."},"notepad-plus-plus":{"cpe":["cpe:2.3:a:notepad-plus-plus:notepad\\+\\+"],"source":"verified","basis":"Top candidate, score 101; 293 dictionary entries; product name appears in the dictionary title ['notepad-plus-plus Notepad++ 8.4.3']. Batch-verified by title corroboration 2026-08-13."},"numpy":{"cpe":["cpe:2.3:a:numpy:numpy"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"nutanix-aos":{"cpe":["cpe:2.3:o:nutanix:aos"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"nutanix-files":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:huawei:files, noise on 'files'. Verified against the full NIST dictionary 2026-08-13."},"nutanix-prism":{"cpe":["cpe:2.3:a:nutanix:prism"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"nuxt":{"cpe":["cpe:2.3:a:nuxt:nuxt"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"nvidia":{"cpe":["cpe:2.3:a:nvidia:gpu_display_driver"],"source":"verified","basis":"297 entries, title 'NVIDIA GPU Display Driver'. Our tracked cycles are driver branches (r610-windows, r595-linux), so the display driver is precisely what this product follows. Verified against the full NIST dictionary 2026-08-13."},"nvidia-gpu":{"cpe":null,"unmapped":true,"source":"verified","reason":"Our tracked cycles are GPU architecture families (consumer-blackwell, mobile-professional-ada-lovelace). The dictionary carries specific chips and software, never an architecture family. Verified against the full NIST dictionary 2026-08-13."},"nvm":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"office":{"cpe":["cpe:2.3:a:microsoft:office"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"oneplus":{"cpe":null,"unmapped":true,"source":"verified","reason":"Our cycles are handset models (15r, 15, 13t). The dictionary holds a handful of old handsets (oneplus_3, oneplus_x) and o:oneplus:oxygenos, the OS. Nothing represents the device line. Verified against the full NIST dictionary 2026-08-13."},"oniguruma":{"cpe":["cpe:2.3:a:oniguruma_project:oniguruma"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"openbao":{"cpe":["cpe:2.3:a:openbao:openbao"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"openbsd":{"cpe":["cpe:2.3:o:openbsd:openbsd"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"openjdk-builds-from-oracle":{"cpe":["cpe:2.3:a:oracle:openjdk"],"source":"verified","basis":"241 entries, title 'Oracle OpenJDK' — exactly Oracle's OpenJDK builds. Verified against the full NIST dictionary 2026-08-13."},"opensearch":{"cpe":["cpe:2.3:a:amazon:opensearch"],"source":"verified","basis":"Top candidate, score 81; 100 dictionary entries; product name appears in the dictionary title ['Amazon OpenSearch 2.5.0']. Batch-verified by title corroboration 2026-08-13."},"openssl":{"cpe":["cpe:2.3:a:openssl:openssl"],"source":"verified","basis":"Top candidate, score 101; 354 dictionary entries; product name appears in the dictionary title ['OpenSSL Project OpenSSL']. Batch-verified by title corroboration 2026-08-13."},"opensuse":{"cpe":["cpe:2.3:o:opensuse:opensuse"],"source":"verified","basis":"Top candidate, score 98.6; 16 dictionary entries; product name appears in the dictionary title ['openSUSE Opensuse 10.3-11.1']. Batch-verified by title corroboration 2026-08-13."},"opentofu":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"openvpn":{"cpe":["cpe:2.3:a:openvpn:openvpn"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"openwrt":{"cpe":["cpe:2.3:o:openwrt:openwrt"],"source":"verified","basis":"Top candidate, score 101; 102 dictionary entries; product name appears in the dictionary title ['OpenWrt']. Batch-verified by title corroboration 2026-08-13."},"openzfs":{"cpe":["cpe:2.3:a:openzfs:openzfs"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"opnsense":{"cpe":["cpe:2.3:a:opnsense:opnsense"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"oracle-apex":{"cpe":["cpe:2.3:a:oracle:apex"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"oracle-database":{"cpe":["cpe:2.3:a:oracle:database"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"oracle-graalvm":{"cpe":["cpe:2.3:a:oracle:graalvm"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"oracle-jdk":{"cpe":["cpe:2.3:a:oracle:jdk"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"oracle-linux":{"cpe":["cpe:2.3:o:oracle:linux"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"oracle-solaris":{"cpe":["cpe:2.3:o:oracle:solaris"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"otobo":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"ovirt":{"cpe":["cpe:2.3:a:ovirt:ovirt-engine"],"source":"verified","basis":"397 entries, 1% deprecated. a:ovirt:ovirt is 100% deprecated; a:redhat:ovirt-engine (371) is Red Hat's rebuild of the same engine. Verified 2026-08-13."},"pangp":{"cpe":["cpe:2.3:a:paloaltonetworks:globalprotect"],"source":"verified","basis":"Our slug abbreviates Palo Alto GlobalProtect. Verified against the full NIST dictionary 2026-08-13."},"panos":{"cpe":["cpe:2.3:o:paloaltonetworks:pan-os"],"source":"verified","basis":"Top candidate, score 81; 779 dictionary entries; product name appears in the dictionary title ['paloaltonetworks pan-os 5.0.14']. Batch-verified by title corroboration 2026-08-13."},"passport":{"cpe":["cpe:2.3:a:passport_project:passport"],"source":"verified","basis":"Top candidate, score 99.5; 32 dictionary entries; product name appears in the dictionary title ['Passport Project Passport 0.6.0 for Node.js']. Batch-verified by title corroboration 2026-08-13."},"pci-dss":{"cpe":null,"unmapped":true,"source":"verified","reason":"PCI DSS is a compliance standard, not software. It cannot have a CPE. Top candidate was a:dahuasecurity:dss_express, noise on 'dss'. Verified against the full NIST dictionary 2026-08-13."},"perl":{"cpe":["cpe:2.3:a:perl:perl"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"phoenix-framework":{"cpe":["cpe:2.3:a:phoenixframework:phoenix"],"source":"verified","basis":"169 entries, title 'Phoenix Framework Phoenix 1.6.15'. Verified against the full NIST dictionary 2026-08-13."},"photon":{"cpe":["cpe:2.3:o:vmware:photon_os"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"php":{"cpe":["cpe:2.3:a:php:php"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"phpbb":{"cpe":["cpe:2.3:a:phpbb:phpbb"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"phpmyadmin":{"cpe":["cpe:2.3:a:phpmyadmin:phpmyadmin"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"pigeonhole":{"cpe":["cpe:2.3:a:dovecot:pigeonhole"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"pixel":{"cpe":["cpe:2.3:h:google:pixel"],"source":"auto","basis":"Matched against the NIST dictionary; vendor-confirmed+covers-distinctive."},"pixel-watch":{"cpe":["cpe:2.3:h:google:pixel_watch"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"plesk":{"cpe":["cpe:2.3:a:plesk:plesk"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"plone":{"cpe":["cpe:2.3:a:plone:plone"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"pnpm":{"cpe":["cpe:2.3:a:pnpm:pnpm"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"podman":{"cpe":["cpe:2.3:a:podman_project:podman"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"pop-os":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was o:apple:iphone_os — pure noise. Pop!_OS has no triple. Verified against the full NIST dictionary 2026-08-13."},"postfix":{"cpe":["cpe:2.3:a:postfix:postfix"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"postgresql":{"cpe":["cpe:2.3:a:postgresql:postgresql"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"postmarketos":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"powershell":{"cpe":["cpe:2.3:a:microsoft:powershell"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"privatebin":{"cpe":["cpe:2.3:a:privatebin:privatebin"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"proftpd":{"cpe":["cpe:2.3:a:proftpd:proftpd"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"prometheus":{"cpe":["cpe:2.3:a:prometheus:prometheus"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"protobuf":{"cpe":["cpe:2.3:a:google:protobuf"],"source":"verified","basis":"406 entries, title 'Google Protobuf'. The matcher chose a:protobuf:protobuf, whose title is 'Protobuf 1.29.0 for Go' — the Go implementation, not Protocol Buffers itself. Verified 2026-08-13."},"protractor":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"proxmox-backup-server":{"cpe":["cpe:2.3:a:proxmox:backup_server"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"proxmox-datacenter-manager":{"cpe":null,"unmapped":true,"source":"verified","reason":"Proxmox has entries for virtual_environment, proxmox_mail_gateway and backup_server, but none for Datacenter Manager (a:intel:datacenter_manager is Intel's unrelated product). a:proxmox:proxmox is a single-entry namesake. Verified against the full NIST dictionary 2026-08-13."},"proxmox-mail-gateway":{"cpe":["cpe:2.3:a:proxmox:proxmox_mail_gateway"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"proxmox-ve":{"cpe":["cpe:2.3:a:proxmox:virtual_environment"],"source":"verified","basis":"43 entries, title 'Proxmox Virtual Environment (VE)'. The matcher had chosen a:proxmox:proxmox, a single-entry namesake. Verified against the full NIST dictionary 2026-08-13."},"puppet":{"cpe":["cpe:2.3:a:puppet:puppet"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"python":{"cpe":["cpe:2.3:a:python:python"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"qt":{"cpe":["cpe:2.3:a:qt:qt"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"quarkus-framework":{"cpe":["cpe:2.3:a:quarkus:quarkus"],"source":"verified","basis":"Top candidate, score 101; 511 dictionary entries; product name appears in the dictionary title ['Quarkus 2.13.7']. Batch-verified by title corroboration 2026-08-13."},"quasar":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:quasar:qmarkdown, one component. The Quasar Framework has no triple. Verified against the full NIST dictionary 2026-08-13."},"rabbitmq":{"cpe":["cpe:2.3:a:broadcom:rabbitmq_server"],"source":"verified","basis":"557 entries, 0% deprecated. Ownership ran Pivotal -> VMware -> Broadcom; a:pivotal_software:rabbitmq is 61% deprecated. Verified 2026-08-13."},"rails":{"cpe":["cpe:2.3:a:rubyonrails:rails"],"source":"verified","basis":"Top candidate, score 81; 509 dictionary entries; product name appears in the dictionary title ['Ruby on Rails Rails 6.0.6.1']. Batch-verified by title corroboration 2026-08-13."},"rancher":{"cpe":["cpe:2.3:a:suse:rancher"],"source":"verified","basis":"804 entries, 0% deprecated; SUSE acquired Rancher. Superseded: the previously chosen triple was 100% deprecated in NIST's dictionary. Deprecated names are not what scanners emit. Verified 2026-08-13."},"raspberry-pi":{"cpe":["cpe:2.3:a:codesys:raspberry_pi"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"react":{"cpe":["cpe:2.3:a:facebook:react"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"react-native":{"cpe":["cpe:2.3:a:facebook:react-native"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"red-hat-ansible-automation-platform":{"cpe":["cpe:2.3:a:redhat:ansible_automation_platform"],"source":"verified","basis":"8 entries, exact title match. ansible_automation_controller (24) is a distinct component. Verified against the full NIST dictionary 2026-08-13."},"red-hat-openshift":{"cpe":["cpe:2.3:a:redhat:openshift_container_platform"],"source":"verified","basis":"992 entries, title 'Red Hat OpenShift Container Platform 4.12'. Our tracked cycles are 4.17-4.22, which ARE Container Platform versions; a:redhat:openshift (76) is titled 'Openshift 3.8', the superseded 3.x product. Verified against the full NIST dictionary 2026-08-13."},"redhat-build-of-openjdk":{"cpe":null,"unmapped":true,"source":"verified","reason":"Same as the Microsoft build — no Red Hat OpenJDK triple exists; only Oracle's. Verified against the full NIST dictionary 2026-08-13."},"redhat-jboss-eap":{"cpe":["cpe:2.3:a:redhat:jboss_enterprise_application_platform"],"source":"verified","basis":"94 entries, exact product name spelled out. The matcher had chosen a:jboss:jboss (2 entries). Verified against the full NIST dictionary 2026-08-13."},"redhat-satellite":{"cpe":["cpe:2.3:a:redhat:satellite"],"source":"verified","basis":"Top candidate, score 81; 208 dictionary entries; product name appears in the dictionary title ['Redhat Satellite 6.1']. Batch-verified by title corroboration 2026-08-13."},"redis":{"cpe":["cpe:2.3:a:redis:redis"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"redmine":{"cpe":["cpe:2.3:a:redmine:redmine"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"renovate":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"requirejs":{"cpe":["cpe:2.3:a:requirejs:requirejs"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"rhel":{"cpe":["cpe:2.3:o:redhat:enterprise_linux"],"source":"verified","basis":"174 entries, title 'Red Hat Enterprise Linux 3.0'. Searching the acronym 'RHEL' returns only add-on products (rhel_extras, rhel_virtualization). Verified 2026-08-13."},"robo":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:robo-ftp:robo-ftp, an unrelated FTP product. Verified against the full NIST dictionary 2026-08-13."},"rocket-chat":{"cpe":["cpe:2.3:a:rocket.chat:rocket.chat"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"rocky-linux":{"cpe":["cpe:2.3:o:resf:rocky_linux"],"source":"verified","basis":"Top candidate, score 78.7; 17 dictionary entries; product name appears in the dictionary title ['The Rocky Enterprise Software Foundation (RESF) Rocky Linux 8.4']. Batch-verified by title corroboration 2026-08-13."},"ros":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:ros:ros-comm, the communications component rather than the ROS distribution we track. Verified against the full NIST dictionary 2026-08-13."},"ros-2":{"cpe":null,"unmapped":true,"source":"verified","reason":"Same as ros — only a:ros:ros-comm exists, and it does not represent ROS 2 distributions. Verified against the full NIST dictionary 2026-08-13."},"roundcube":{"cpe":["cpe:2.3:a:roundcube:webmail"],"source":"verified","basis":"214 entries, 5% deprecated, title 'roundcube Webmail 1.0.3'. Both a:roundcube:roundcube and a:roundcube:roundcube_webmail are 100% deprecated. Caught by the verifier's deprecation check, which matters here because we publish a Roundcube CVE article. Verified 2026-08-13."},"routeros":{"cpe":["cpe:2.3:o:mikrotik:routeros"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"rtpengine":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"ruby":{"cpe":["cpe:2.3:a:ruby-lang:ruby"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"rust":{"cpe":["cpe:2.3:a:rust-lang:rust"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"salt":{"cpe":["cpe:2.3:a:saltstack:salt"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"samsung-galaxy-tab":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:galaxyproject:galaxy, the unrelated bioinformatics platform. Our samsung-mobile product is mapped separately. Verified against the full NIST dictionary 2026-08-13."},"samsung-galaxy-watch":{"cpe":["cpe:2.3:h:samsung:galaxy_watch"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"samsung-mobile":{"cpe":["cpe:2.3:o:samsung:samsung_mobile"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"sap-ecc":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:devsaran:business, noise. SAP ECC has no triple. Verified against the full NIST dictionary 2026-08-13."},"sapmachine":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"scala":{"cpe":["cpe:2.3:a:scala-lang:scala"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"sharepoint":{"cpe":["cpe:2.3:a:microsoft:sharepoint_server"],"source":"verified","basis":"37 entries. The matcher had chosen sharepoint_foundation (5), one edition rather than the product. Higher-count rivals are third-party tools (Zoho, Symantec). Verified against the full NIST dictionary 2026-08-13."},"shopware":{"cpe":["cpe:2.3:a:shopware:shopware"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"silverstripe":{"cpe":["cpe:2.3:a:silverstripe:silverstripe"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"slackware":{"cpe":["cpe:2.3:a:slackware:slackware"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"sles":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"snakeyaml":{"cpe":["cpe:2.3:a:snakeyaml_project:snakeyaml"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"sns-firmware":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was o:amazonbasics:firmware, noise on 'firmware'. Verified against the full NIST dictionary 2026-08-13."},"sns-hardware":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:icansoft:korea_sns, noise. Verified against the full NIST dictionary 2026-08-13."},"sns-smc":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was o:smc:smc8024l2_switch_firmware, noise. Verified against the full NIST dictionary 2026-08-13."},"solr":{"cpe":["cpe:2.3:a:apache:solr"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"sonarqube-community":{"cpe":["cpe:2.3:a:sonarsource:sonarqube"],"source":"verified","basis":"196 entries. Same entry as sonarqube-server; the dictionary does not separate the editions. Verified against the full NIST dictionary 2026-08-13."},"sonarqube-server":{"cpe":["cpe:2.3:a:sonarsource:sonarqube"],"source":"verified","basis":"196 entries. SonarQube Server and Community share one dictionary entry and one version line. Verified against the full NIST dictionary 2026-08-13."},"sony-xperia":{"cpe":null,"unmapped":true,"source":"verified","reason":"17 candidate triples, all individual handsets and their firmware. Verified against the full NIST dictionary 2026-08-13."},"sourcegraph":{"cpe":["cpe:2.3:a:sourcegraph:sourcegraph"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"splunk":{"cpe":["cpe:2.3:a:splunk:splunk"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"spring-boot":{"cpe":["cpe:2.3:a:vmware:spring_boot"],"source":"verified","basis":"Top candidate, score 81; 351 dictionary entries; product name appears in the dictionary title ['VMware Spring Boot 2.7.11']. Batch-verified by title corroboration 2026-08-13."},"spring-cloud":{"cpe":null,"unmapped":true,"source":"verified","reason":"The dictionary carries individual Spring Cloud projects (spring_cloud_config, spring_cloud_gateway, spring_cloud_function, spring_cloud_data_flow), not Spring Cloud as the release train we track. Verified against the full NIST dictionary 2026-08-13."},"spring-framework":{"cpe":["cpe:2.3:a:vmware:spring_framework"],"source":"verified","basis":"Top candidate, score 81; 352 dictionary entries; product name appears in the dictionary title ['Vmware Spring Framework 5.3.23']. Batch-verified by title corroboration 2026-08-13."},"spring-security":{"cpe":["cpe:2.3:a:vmware:spring_security"],"source":"verified","basis":"Top candidate, score 81; 396 dictionary entries; product name appears in the dictionary title ['VMware Spring Security 5.7.0']. Batch-verified by title corroboration 2026-08-13."},"sqlite":{"cpe":["cpe:2.3:a:sqlite:sqlite"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"squid":{"cpe":["cpe:2.3:a:squid-cache:squid"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"statamic":{"cpe":["cpe:2.3:a:statamic:statamic"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"steamos":{"cpe":["cpe:2.3:o:valvesoftware:steamos"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"strapi":{"cpe":["cpe:2.3:a:strapi:strapi"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"surface":{"cpe":null,"unmapped":true,"source":"verified","reason":"95 candidate triples, all per-model firmware (surface_pro_1_firmware through surface_pro_8_firmware). Nothing represents the Surface line. Verified against the full NIST dictionary 2026-08-13."},"suse-linux-micro":{"cpe":["cpe:2.3:o:suse:linux_micro"],"source":"auto","basis":"Matched against the NIST dictionary; same-vendor-more-specific."},"suse-manager":{"cpe":["cpe:2.3:a:suse:manager"],"source":"auto","basis":"Matched against the NIST dictionary; vendor-confirmed+covers-distinctive."},"svelte":{"cpe":["cpe:2.3:a:svelte:svelte"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"symfony":{"cpe":["cpe:2.3:a:sensiolabs:symfony"],"source":"verified","basis":"Top candidate, score 81; 879 dictionary entries; product name appears in the dictionary title ['SensioLabs Symfony 2.3.19']. Batch-verified by title corroboration 2026-08-13."},"tails":{"cpe":["cpe:2.3:o:tails_project:tails"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"tailwind-css":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:css-what_project:css-what — noise on 'css'. Tailwind CSS has no triple. Verified against the full NIST dictionary 2026-08-13."},"tarantool":{"cpe":["cpe:2.3:a:tarantool:tarantool"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"tarteaucitron":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:ameos_tarteaucitron_project:ameos_tarteaucitron, a TYPO3 extension rather than the tarteaucitron.js library. Verified against the full NIST dictionary 2026-08-13."},"teamcity":{"cpe":["cpe:2.3:a:jetbrains:teamcity"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"telegraf":{"cpe":null,"unmapped":true,"source":"verified","reason":"Only a:influxdata:telegraf_docker_image (98 entries, the container image) and NetApp Cloud Insights variants. No entry for Telegraf itself. Verified against the full NIST dictionary 2026-08-13."},"teleport":{"cpe":["cpe:2.3:a:goteleport:teleport"],"source":"verified","basis":"Top candidate, score 81; 198 dictionary entries; product name appears in the dictionary title ['Goteleport Teleport 3.5.6 Release Candidate 6']. Batch-verified by title corroboration 2026-08-13."},"terraform":{"cpe":["cpe:2.3:a:hashicorp:terraform"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"thumbor":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"tinymce":{"cpe":["cpe:2.3:a:tiny:tinymce"],"source":"verified","basis":"325 entries, 0% deprecated; vendor is Tiny. The matcher chose a:tinymce:tinymce, a single-entry namesake. Verified 2026-08-13."},"tls":{"cpe":null,"unmapped":true,"source":"verified","reason":"TLS is a protocol, not a product. The only near matches are implementations (mbedTLS, Rambus TLS Toolkit). Verified against the full NIST dictionary 2026-08-13."},"tomcat":{"cpe":["cpe:2.3:a:apache:tomcat"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"traefik":{"cpe":["cpe:2.3:a:traefik:traefik"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"tvos":{"cpe":["cpe:2.3:o:apple:tvos"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"twig":{"cpe":["cpe:2.3:a:symfony:twig"],"source":"verified","basis":"Top candidate, score 81; 270 dictionary entries; product name appears in the dictionary title ['Symfony Twig 0.9.0']. Batch-verified by title corroboration 2026-08-13."},"typo3":{"cpe":["cpe:2.3:a:typo3:typo3"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"ubuntu":{"cpe":["cpe:2.3:o:canonical:ubuntu_linux"],"source":"verified","basis":"124 entries, title 'Canonical Ubuntu Linux 12.04 LTS'. Top-scoring candidate was a:cononical:ubuntu — a misspelling of Canonical in NIST's own dictionary with a single entry. Verified 2026-08-13."},"umbraco":{"cpe":["cpe:2.3:a:umbraco:umbraco_cms"],"source":"verified","basis":"596 entries, title 'Umbraco CMS'. The matcher had chosen umbraco_forms, a separate add-on; bare a:umbraco:umbraco holds one 100%-deprecated entry. Verified against the full NIST dictionary 2026-08-13."},"unity":{"cpe":["cpe:2.3:a:ayatana_project:unity"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"unrealircd":{"cpe":["cpe:2.3:a:unrealircd:unrealircd"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"valkey":{"cpe":["cpe:2.3:a:lfprojects:valkey"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"vcenter":{"cpe":["cpe:2.3:a:vmware:vcenter_server"],"source":"verified","basis":"235 entries, 26% deprecated (under threshold), title 'VMware vCenter Server'. Verified against the full NIST dictionary 2026-08-13."},"veeam-backup-and-replication":{"cpe":["cpe:2.3:a:veeam:veeam_backup_\\&_replication"],"source":"verified","basis":"39 entries, 0% deprecated. NIST holds two entries; a:veeam:backup_\\&_replication is 100% deprecated despite carrying newer version strings. Deprecation, not version recency, decides. Verified 2026-08-13."},"veeam-backup-for-microsoft-365":{"cpe":null,"unmapped":true,"source":"verified","reason":"a:veeam:backup is titled 'Veeam Backup 8.0.1.202 for Microsoft Azure' — a different product. No Microsoft 365 triple exists. Verified against the full NIST dictionary 2026-08-13."},"veeam-one":{"cpe":["cpe:2.3:a:veeam:one"],"source":"auto","basis":"Matched against the NIST dictionary; vendor-confirmed+covers-distinctive."},"vinyl-cache":{"cpe":["cpe:2.3:a:vinyl-cache:vinyl_cache"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"virtualbox":{"cpe":["cpe:2.3:a:oracle:virtualbox"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"visionos":{"cpe":["cpe:2.3:o:apple:visionos"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"visual-cobol":{"cpe":["cpe:2.3:a:microfocus:visual_cobol"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"visual-studio":{"cpe":["cpe:2.3:a:microsoft:visual_studio"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"vitess":{"cpe":["cpe:2.3:a:linuxfoundation:vitess"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"vmware-cloud-foundation":{"cpe":["cpe:2.3:a:vmware:cloud_foundation"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"vmware-harbor-registry":{"cpe":["cpe:2.3:a:pivotal:vmware_harbor_registry"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"vmware-srm":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:emc:vmware, noise. Site Recovery Manager has no triple. Verified against the full NIST dictionary 2026-08-13."},"vue":{"cpe":null,"unmapped":true,"source":"verified","reason":"9 candidate triples, none is Vue.js core: a:vuejs:vue_cli is the CLI, a:vuejs:devtools the browser extension, the rest unrelated (Vuetify, Vuelidate). Verified against the full NIST dictionary 2026-08-13."},"vuetify":{"cpe":["cpe:2.3:a:vuetifyjs:vuetify"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"wagtail":{"cpe":["cpe:2.3:a:torchbox:wagtail"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"watchos":{"cpe":["cpe:2.3:o:apple:watchos"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"weakforced":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"webpack":{"cpe":["cpe:2.3:a:webpack.js:webpack"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"weechat":{"cpe":["cpe:2.3:a:weechat:weechat"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"windows":{"cpe":null,"unmapped":true,"source":"verified","reason":"No usable identifier exists. Every aggregate Windows triple is deprecated — o:microsoft:windows 64%, windows_10 97%, windows_11 83%, windows_server 100% (whose title is even mis-set to PowerPoint). The dictionary fragments Windows per build (windows_10_1607, windows_10_21h2, windows_server_2022), while our cycles are feature releases per edition (11-26h1-e). Mapping at PRODUCT level is impossible; per-VERSION mapping is viable and is the natural next step for this pipeline. Verified against the full NIST dictionary 2026-08-13."},"windows-embedded":{"cpe":null,"unmapped":true,"source":"verified","reason":"Only o:microsoft:windows_embedded_compact exists, one specific edition rather than the Embedded family we track. Verified against the full NIST dictionary 2026-08-13."},"windows-nano-server":{"cpe":null,"unmapped":true,"source":"verified","reason":"No o:microsoft:windows_nano_server triple exists. Top candidate was a:gnu:nano, the text editor. Verified against the full NIST dictionary 2026-08-13."},"windows-powershell":{"cpe":["cpe:2.3:a:microsoft:powershell"],"source":"verified","basis":"393 entries. Verified against the full NIST dictionary 2026-08-13."},"windows-server":{"cpe":null,"unmapped":true,"source":"verified","reason":"Same as windows: o:microsoft:windows_server is 100% deprecated and the live entries are per-release (windows_server_2022, 346 entries). Product-level mapping would be wrong; version-level is viable later. Verified against the full NIST dictionary 2026-08-13."},"windows-server-core":{"cpe":null,"unmapped":true,"source":"verified","reason":"No o:microsoft:windows_server_core triple exists. Top candidate was a:api-platform:core, unrelated. Verified against the full NIST dictionary 2026-08-13."},"wireshark":{"cpe":["cpe:2.3:a:wireshark:wireshark"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"wordpress":{"cpe":["cpe:2.3:a:wordpress:wordpress"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"xcp-ng":{"cpe":null,"unmapped":true,"source":"verified","reason":"Top candidate was a:pyload-ng_project:pyload-ng — noise on the '-ng' suffix. XCP-ng has no triple. Verified against the full NIST dictionary 2026-08-13."},"yarn":{"cpe":["cpe:2.3:a:yarnpkg:yarn"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"yocto":{"cpe":["cpe:2.3:a:linuxfoundation:yocto"],"source":"verified","basis":"Top candidate, score 81; 179 dictionary entries; product name appears in the dictionary title ['Linux Foundation Yocto 2.6']. Batch-verified by title corroboration 2026-08-13."},"youtrack":{"cpe":["cpe:2.3:a:jetbrains:youtrack"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"yui":{"cpe":["cpe:2.3:a:yui_project:yui"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"zabbix":{"cpe":["cpe:2.3:a:zabbix:zabbix"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"zentyal":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"zerto":{"cpe":null,"unmapped":true,"source":"no-candidate","reason":"No candidate in the NIST CPE dictionary matches this product."},"zookeeper":{"cpe":["cpe:2.3:a:apache:zookeeper"],"source":"auto","basis":"Matched against the NIST dictionary; strong+clear-margin."},"zos":{"cpe":["cpe:2.3:o:ibm:z\\/os"],"source":"verified","basis":"Top candidate, score 98.8; 19 dictionary entries; product name appears in the dictionary title ['IBM Z/os 2.4.0']. Batch-verified by title corroboration 2026-08-13."}}}