Vulnerability Disclosure (CVE Numbering Authorities, FIRST member teams; CISA KEV exposure)

Where this market publishes its structure

• CVE Program CNA list (raw.githubusercontent.com/CVEProject/cve-website/dev/src/assets/data/CNAsList.json @ 239d3d9b68e0) machine-readable, 200 JSON; 559 CNAs (Vendor 456, Open Source 147, Researcher 124); 185 in-market providers linked by the CNA's own domain; 291 own domains held by no repo; 25 held (CERT / consortium / public)
• FIRST member teams (api.first.org/data/v1/teams) machine-readable, 200 public JSON, no key; 891 full-member teams; 67 in-market providers linked; 127 held (national / sector CERTs, governments, universities); end-user CSIRTs gated out by tags
• CISA Known Exploited Vulnerabilities (cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) machine-readable, 200 JSON, catalog 2026.10.21, 1,754 entries; vendorProject matched to 48 cohort members by normalised name; exposure, reported beside the cohort only, never an edge or a score
• cve.org partner pages (www.cve.org/PartnerInformation/ListofPartners) not machine-readable: client-rendered; not needed: the same data is the CNAsList.json the site renders

Own = declares at least one integration itself; covered = visible only because an aggregator, standards body, regulator or partner contract names it; distribution-only = listed only on cloud marketplaces it sells through, a channel reported beside, never counted as its own declared integrations; undeclared = nothing we can read, so no number; declares_compatibility = providers with a `compatible` shape vote, report only (kin, 2026-10-13): never counted as own, never in depth or position.

Taxonomy how this market maps onto apis.io

Derived 2026-10-23 from the 211 providers in this market we could resolve in the catalog. The percentage is the share of those providers carrying each one; it describes the market, not the tag or industry. Tag groups have no page of their own yet, so they are listed unlinked.

share of resolved cohort carrying it; tags >=0.20 & >=3 members (max 12, junk dropped), tag_groups >=0.20 (cooccurrence, non-cross-cutting; max 8), industries >=0.20 (max 6), areas >=0.10 (max 6; areas are keyword-matched and sparse), capabilities L1 >=0.20 (max 8); derive-market-taxonomy.py

Leaders by position (provisional)

Provisional: grouped by position, depth compared within a position only. Distribution (cloud marketplaces) and iPaaS bridges are counted beside position, never inside it. Unknown-builder listings are left out of position shares and counted here.

undeclared 211 · declares nothing we can read: no number