CVE Numbering Authority — organization authorized to assign CVE IDs to vulnerabilities affecting products