Repository: aquasecurity/vuln-list-update

Issue:
bug(debian): vuln-list-update doesn't save `updates-source` dir
## Description
`vuln-list-update` doesn't save `updates-source` dir.

## Solution
It looks like debian changed link for security sources
New link is `https://security.debian.org/debian-security/dists/%s-security/updates/%s/source/Sources.xz`
e.g. https://security.debian.org/debian-security/dists/bookworm-security/updates/main/source/Sources.xz

Discussion:

Solution patch:
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index efc6269..08324bd 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -88,8 +88,8 @@ jobs:
         run: ./scripts/update.sh azure "Azure Linux and CBL-Mariner Vulnerability Data"
 
       - if: always()
-        name: OSV Database
-        run: ./scripts/update.sh osv "OSV Database"
+        name: OSV Database (osv.dev)
+        run: ./scripts/update.sh osvdev "OSV Database"
 
       - if: always()
         name: Wolfi Secdb
@@ -111,6 +111,10 @@ jobs:
         name: MinimOS Secdb
         run: ./scripts/update.sh minimos "MinimOS Security Data"
 
+      - if: always()
+        name: Seal Security
+        run: ./scripts/update.sh seal "Seal Security Data"
+
       - if: always()
         name: EOL dates
         run: ./scripts/update.sh eoldates "EOL dates"
diff --git a/README.md b/README.md
index 8d0d882..2bfbf5f 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,7 @@ https://github.com/aquasecurity/vuln-list/
 $ vuln-list-update -h
 Usage of vuln-list-update:
   -target string
-        update target (nvd, alpine, alpine-unfixed, redhat, redhat-oval, debian, ubuntu, amazon, oracle-oval, suse-cvrf, photon, arch-linux, ghsa, glad, cwe, osv, mariner, kevc, wolfi, chainguard, azure, openeuler, echo, minimos, rootio)
+        update target (nvd, alpine, alpine-unfixed, redhat, redhat-oval, debian, ubuntu, amazon, oracle-oval, suse-cvrf, photon, arch-linux, ghsa, glad, cwe, osv, mariner, kevc, wolfi, chainguard, azure, openeuler, echo, minimos, rootio, seal)
   -target-branch string
     	alternative repository branch (only glad)
   -target-uri string
diff --git a/cwe/cwe_types.go b/cwe/cwe_types.go
index aa64531..7166852 100644
--- a/cwe/cwe_types.go
+++ b/cwe/cwe_types.go
@@ -1,66 +1,518 @@
-// This was partially auto-generated through: https://github.com/droyo/go-xml
-// Schema: https://cwe.mitre.org/data/xsd/cwe_schema_latest.xsd
+// Code generated by xsdgen. DO NOT EDIT.
+// Schema source: https://cwe.mitre.org/data/xsd/cwe_schema_v7.2.xsd
 
 package cwe
 
 import (
+	"bytes"
 	"encoding/xml"
+	"time"
 )
 
-type RelatedAttackPattern struct {
-	CAPECID int `xml:"CAPEC_ID,attr"`
+// May be one of Pillar, Class, Base, Variant, Compound
+type AbstractionEnumeration string
+
+// The AffectedResourcesType complex type is used to identify system resources that can be affected by an exploit of this weakness. If multiple resources could be affected, then each should be defined by its own Affected_Resource element.
+type AffectedResourcesType struct {
+	AffectedResource []ResourceEnumeration `xml:"http://cwe.mitre.org/cwe-7 Affected_Resource"`
 }
 
-// The RelatedAttackPatternsType complex type contains references to attack patterns associated with this weakness. The association implies those attack patterns may be applicable if an instance of this weakness exists. Each related attack pattern is identified by a CAPEC identifier.
-type RelatedAttackPatternsType struct {
-	RelatedAttackPattern []RelatedAttackPattern `xml:"http://cwe.mitre.org/cwe-6 Related_Attack_Pattern"`
+type AlternateTerm struct {
+	Term        string             `xml:"http://cwe.mitre.org/cwe-7 Term"`
+	Description StructuredTextType `xml:"http://cwe.mitre.org/cwe-7 Description,omitempty"`
 }
 
-type Mitigation struct {
-	Phase       []PhaseEnumeration            `xml:"http://cwe.mitre.org/cwe-6 Phase,omitempty"`
-	Strategy    MitigationStrategyEnumeration `xml:"http://cwe.mitre.org/cwe-6 Strategy,omitempty"`
-	Description StructuredTextType            `xml:"http://cwe.mitre.org/cwe-6 Description"`
+// The AlternateTermsType complex type indicates one or more other names used to describe this weakness. The required Term element contains the actual alternate term. The required Description element provides context for each alternate term by which this weakness may be known.
+type AlternateTermsType struct {
+	AlternateTerm []AlternateTerm `xml:"http://cwe.mitre.org/cwe-7 Alternate_Term"`
 }
 
-// May be one of Policy, Requirements, Architecture and Design, Implementation, Build and Compilation, Testing, Documentation, Bundling, Distribution, Installation, System Configuration, Operation, Patching and Maintenance, Porting, Integration, Manufacturing
-type PhaseEnumeration string
+// The ApplicablePlatformsType complex type specifies the languages, operating systems, architectures, and technologies in which a given weakness could appear. A technology represents a generally accepted feature of a system and often refers to a high-level functional component within a system. The required Prevalence attribute identifies the regularity with which the weakness is applicable to that platform. When providing an operating system name, an optional Common Platform Enumeration (CPE) identifier can be used to a identify a specific OS.
+type ApplicablePlatformsType struct {
+	Language        []Language        `xml:"http://cwe.mitre.org/cwe-7 Language,omitempty"`
+	OperatingSystem []OperatingSystem `xml:"http://cwe.mitre.org/cwe-7 Operating_System,omitempty"`
+	Architecture    []Architecture    `xml:"http://cwe.mitre.org/cwe-7 Architecture,omitempty"`
+	Technology      []Technology      `xml:"http://cwe.mitre.org/cwe-7 Technology,omitempty"`
+}
 
-// May be one of Attack Surface Reduction, Compilation or Build Hardening, Enforcement by Conversion, Environment Hardening, Firewall, Input Validation, Language Selection, Libraries or Frameworks, Resource Limitation, Output Encoding, Parameterization, Refactoring, Sandbox or Jail, Separation of Privilege
-type MitigationStrategyEnumeration string
+type Architecture struct {
+	Name       ArchitectureNameEnumeration  `xml:"Name,attr,omitempty"`
+	Class      ArchitectureClassEnumeration `xml:"Class,attr,omitempty"`
+	Prevalence PrevalenceEnumeration        `xml:"Prevalence,attr"`
+}
 
-// The PotentialMitigationsType complex type is used to describe potential mitigations associated with a weakness. It contains one or more Mitigation elements, which each represent individual mitigations for the weakness. The Phase element indicates the development life cycle phase during which this particular mitigation may be applied. The Strategy element describes a general strategy for protecting a system to which this mitigation contributes. The Effectiveness element summarizes how effective the mitigation may be in preventing the weakness. The Description element contains a description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness.
+// May be one of Embedded, Microcomputer, Workstation, Not Architecture-Specific
+type ArchitectureClassEnumeration string
+
+// May be one of Alpha, ARM, Itanium, Power Architecture, SPARC, x86, Other
+type ArchitectureNameEnumeration string
+
+// The AudienceType complex type provides a reference to the target stakeholders or groups for a view. For each stakeholder, the required Type element specifies the type of members that might be interested in the view. The required Description element provides some text describing what properties of the view this particular stakeholder might find useful.
+type AudienceType struct {
+	Stakeholder []Stakeholder `xml:"http://cwe.mitre.org/cwe-7 Stakeholder"`
+}
+
+// The BackgroundDetailsType complex type contains one or more Background_Detail elements, each of which contains information that is relevant but not related to the nature of the weakness itself.
+type BackgroundDetailsType struct {
+	BackgroundDetail []StructuredTextType `xml:"http://cwe.mitre.org/cwe-7 Background_Detail"`
+}
+
+type Categories struct {
+	Category []CategoryType `xml:"http://cwe.mitre.org/cwe-7 Category"`
+}
+
+// A category is a collection of weaknesses based on some common characteristic or attribute. The shared attribute may be any number of things including, but not limited to, environment (J2EE, .NET), functional area (authentication, cryptography) and the relevant resource (credentials management, certificate issues). A Category is used primarily as an organizational mechanism for CWE and should not be mapped to by external sources.
 //
-// The optional Mitigation_ID attribute is used by the internal CWE team to uniquely identify mitigations that are repeated across any number of individual weaknesses. To help make sure that the details of these common mitigations stay synchronized, the Mitigation_ID is used to quickly identify those mitigation elements across CWE that should be identical. The identifier is a string and should match the following format: MIT-1.
-type PotentialMitigationsType struct {
-	Mitigation []Mitigation `xml:"http://cwe.mitre.org/cwe-6 Mitigation"`
+// The required Summary element contains the key points that define the category and helps the user understand what the category is attempting to be. The optional Relationships element is used to define relationships (Member_Of and Has_Member) with other weaknesses, categories, and views. The optional Taxonomy_Mappings element is used to relate this category to similar categories in taxomomies outside of CWE. The optional References element is used to provide further reading and insight into this category. This element should be used when the category is based on external sources or projects. The optional Notes element is used to provide additional comments or clarifications that cannot be captured using the other elements of the category. The optional Content_History element is used to keep track of the original author of the category and any subsequent modifications to the content. This provides a means of contacting the authors and modifiers for clarifying ambiguities, or in merging overlapping contributions.
+//
+// The required ID attribute provides a unique identifier for the category. It is meant to be static for the lifetime of the category. If the category becomes deprecated, the ID should not be reused, and a placeholder for the deprecated category should be left in the catalog. The required Name attribute provides a descriptive title used to give the reader an idea of what characteristics this category represents. All words in the name should be capitalized except for articles and prepositions unless they begin or end the name. The required Status attribute defines the maturity of the information for this category. Please refer to the StatusEnumeration simple type for a list of valid values and their meanings.
+type CategoryType struct {
+	Summary          StructuredTextType   `xml:"http://cwe.mitre.org/cwe-7 Summary"`
+	Relationships    RelationshipsType    `xml:"http://cwe.mitre.org/cwe-7 Relationships,omitempty"`
+	TaxonomyMappings TaxonomyMappingsType `xml:"http://cwe.mitre.org/cwe-7 Taxonomy_Mappings,omitempty"`
+	References       ReferencesType       `xml:"http://cwe.mitre.org/cwe-7 References,omitempty"`
+	MappingNotes     MappingNotesType     `xml:"http://cwe.mitre.org/cwe-7 Mapping_Notes"`
+	Notes            NotesType            `xml:"http://cwe.mitre.org/cwe-7 Notes,omitempty"`
+	ContentHistory   ContentHistoryType   `xml:"http://cwe.mitre.org/cwe-7 Content_History"`
+	ID               int                  `xml:"ID,attr"`
+	Name             string               `xml:"Name,attr"`
+	Status           StatusEnumeration    `xml:"Status,attr"`
 }
 
 // The CommonConsequencesType complex type is used to specify individual consequences associated with a weakness. The required Scope element identifies the security property that is violated. The optional Impact element describes the technical impact that arises if an adversary succeeds in exploiting this weakness. The optional Likelihood element identifies how likely the specific consequence is expected to be seen relative to the other consequences. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact. The optional Note element provides additional commentary about a consequence.
 //
 // The optional Consequence_ID attribute is used by the internal CWE team to uniquely identify examples that are repeated across any number of individual weaknesses. To help make sure that the details of these common examples stay synchronized, the Consequence_ID is used to quickly identify those examples across CWE that should be identical. The identifier is a string and should match the following format: CC-1.
 type CommonConsequencesType struct {
-	Consequence []Consequence `xml:"http://cwe.mitre.org/cwe-6 Consequence"`
+	Consequence []Consequence `xml:"http://cwe.mitre.org/cwe-7 Consequence"`
 }
 
 type Consequence struct {
-	Scope  []ScopeEnumeration           `xml:"http://cwe.mitre.org/cwe-6 Scope"`
-	Impact []TechnicalImpactEnumeration `xml:"http://cwe.mitre.org/cwe-6 Impact,omitempty"`
+	Scope         []ScopeEnumeration           `xml:"http://cwe.mitre.org/cwe-7 Scope"`
+	Impact        []TechnicalImpactEnumeration `xml:"http://cwe.mitre.org/cwe-7 Impact"`
+	Likelihood    LikelihoodEnumeration        `xml:"http://cwe.mitre.org/cwe-7 Likelihood,omitempty"`
+	Note          StructuredTextType           `xml:"http://cwe.mitre.org/cwe-7 Note,omitempty"`
+	ConsequenceID string                       `xml:"Consequence_ID,attr,omitempty"`
 }
 
-// May be one of Modify Memory, Read Memory, Modify Files or Directories, Read Files or Directories, Modify Application Data, Read Application Data, DoS: Crash, Exit, or Restart, DoS: Amplification, DoS: Instability, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other), Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Bypass Protection Mechanism, Hide Activities, Alter Execution Logic, Quality Degradation, Unexpected State, Varies by Context, Reduce Maintainability, Reduce Performance, Reduce Reliability, Other
-type TechnicalImpactEnumeration string
+// The ContentHistoryType complex type provides elements to keep track of the original author of an entry and any subsequent modifications to the content. The required Submission element is used to identify the submitter and/or their organization, the date on which the submission was made, the CWE version and release date in which the new CWE entry was added, and any optional comments related to an entry. The optional Modification element is used to identify a modifier's name, organization, the date on which the Modification was made or suggested, the CWE version and release date in which the modification first appeared, and any related comments. A new Modification element should exist for each change made to the content. Modifications that change the meaning of the entry, or how it might be interpreted, should be marked with an importance of critical to bring it to the attention of anyone previously dependent on the weakness.  The optional Contribution element is used to identify a contributor's name, organization, the date, the CWE version and release date in which the contribution first appeared, and any related comments. This element has a single Type attribute, which indicates whether the contribution was part of general feedback given or actual content that was donated. The optional Previous_Entry_Name element is used to describe a previous name that was used for the entry. This should be filled out whenever a substantive name change occurs. The required Date attribute lists the date on which this name was no longer used, typically the date of the first CWE release that changed the previous name.  A Previous_Entry_Name element should align with a corresponding Modification element.
+type ContentHistoryType struct {
+	Submission        Submission          `xml:"http://cwe.mitre.org/cwe-7 Submission"`
+	Modification      []Modification      `xml:"http://cwe.mitre.org/cwe-7 Modification,omitempty"`
+	Contribution      []Contribution      `xml:"http://cwe.mitre.org/cwe-7 Contribution,omitempty"`
+	PreviousEntryName []PreviousEntryName `xml:"http://cwe.mitre.org/cwe-7 Previous_Entry_Name,omitempty"`
+}
+
+type Contribution struct {
+	ContributionName         string    `xml:"http://cwe.mitre.org/cwe-7 Contribution_Name,omitempty"`
+	ContributionOrganization string    `xml:"http://cwe.mitre.org/cwe-7 Contribution_Organization,omitempty"`
+	ContributionDate         time.Time `xml:"http://cwe.mitre.org/cwe-7 Contribution_Date"`
+	ContributionVersion      string    `xml:"http://cwe.mitre.org/cwe-7 Contribution_Version,omitempty"`
+	ContributionReleaseDate  time.Time `xml:"http://cwe.mitre.org/cwe-7 Contribution_ReleaseDate,omitempty"`
+	ContributionComment      string    `xml:"http://cwe.mitre.org/cwe-7 Contribution_Comment,omitempty"`
+	Type                     Type      `xml:"Type,attr"`
+}
+
+func (t *Contribution) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	type T Contribution
+	var layout struct {
+		*T
+		ContributionDate        *xsdDate `xml:"http://cwe.mitre.org/cwe-7 Contribution_Date"`
+		ContributionReleaseDate *xsdDate `xml:"http://cwe.mitre.org/cwe-7 Contribution_ReleaseDate,omitempty"`
+	}
+	layout.T = (*T)(t)
+	layout.ContributionDate = (*xsdDate)(&layout.T.ContributionDate)
+	layout.ContributionReleaseDate = (*xsdDate)(&layout.T.ContributionReleaseDate)
+	return e.EncodeElement(layout, start)
+}
+func (t *Contribution) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
+	type T Contribution
+	var overlay struct {
+		*T
+		ContributionDate        *xsdDate `xml:"http://cwe.mitre.org/cwe-7 Contribution_Date"`
+		ContributionReleaseDate *xsdDate `xml:"http://cwe.mitre.org/cwe-7 Contribution_ReleaseDate,omitempty"`
+	}
+	overlay.T = (*T)(t)
+	overlay.ContributionDate = (*xsdDate)(&overlay.T.ContributionDate)
+	overlay.ContributionReleaseDate = (*xsdDate)(&overlay.T.ContributionReleaseDate)
+	return d.DecodeElement(&overlay, &start)
+}
+
+type DemonstrativeExample struct {
+	TitleText              string             `xml:"http://cwe.mitre.org/cwe-7 Title_Text,omitempty"`
+	IntroText              StructuredTextType `xml:"http://cwe.mitre.org/cwe-7 Intro_Text"`
+	BodyText               StructuredTextType `xml:"http://cwe.mitre.org/cwe-7 Body_Text,omitempty"`
+	ExampleCode            StructuredCodeType `xml:"http://cwe.mitre.org/cwe-7 Example_Code,omitempty"`
+	References             ReferencesType     `xml:"http://cwe.mitre.org/cwe-7 References,omitempty"`
+	DemonstrativeExampleID string             `xml:"Demonstrative_Example_ID,attr,omitempty"`
+}
+
+// The DemonstrativeExamplesType complex type contains one or more Demonstrative_Example elements, each of which contains an example illustrating how a weakness may look in actual code. The optional Title_Text element provides a title for the example. The Intro_Text element describes the context and setting in which this code should be viewed, summarizing what the code is attempting to do. The Body_Text and Example_Code elements are a mixture of code and explanatory text about the example. The References element provides additional information.
+//
+// The optional Demonstrative_Example_ID attribute is used by the internal CWE team to uniquely identify examples that are repeated across any number of individual weaknesses. To help make sure that the details of these common examples stay synchronized, the Demonstrative_Example_ID is used to quickly identify those examples across CWE that should be identical. The identifier is a string and should match the following format: DX-1.
+type DemonstrativeExamplesType struct {
+	DemonstrativeExample []DemonstrativeExample `xml:"http://cwe.mitre.org/cwe-7 Demonstrative_Example"`
+}
+
+// May be one of High, Moderate, SOAR Partial, Opportunistic, Limited, None
+type DetectionEffectivenessEnumeration string
+
+type DetectionMethod struct {
+	Method             DetectionMethodEnumeration        `xml:"http://cwe.mitre.org/cwe-7 Method"`
+	Description        StructuredTextType                `xml:"http://cwe.mitre.org/cwe-7 Description"`
+	Effectiveness      DetectionEffectivenessEnumeration `xml:"http://cwe.mitre.org/cwe-7 Effectiveness,omitempty"`
+	EffectivenessNotes StructuredTextType                `xml:"http://cwe.mitre.org/cwe-7 Effectiveness_Notes,omitempty"`
+	DetectionMethodID  string                            `xml:"Detection_Method_ID,attr,omitempty"`
+}
+
+// May be one of Automated Analysis, Automated Dynamic Analysis, Automated Static Analysis, Automated Static Analysis - Source Code, Automated Static Analysis - Binary or Bytecode, Fuzzing, Manual Analysis, Manual Dynamic Analysis, Manual Static Analysis, Manual Static Analysis - Source Code, Manual Static Analysis - Binary or Bytecode, White Box, Black Box, Architecture or Design Review, Dynamic Analysis with Manual Results Interpretation, Dynamic Analysis with Automated Results Interpretation, Formal Verification, Simulation / Emulation, Other
+type DetectionMethodEnumeration string
+
+// The DetectionMethodsType complex type is used to identify methods that may be employed to detect this weakness, including their strengths and limitations. The required Method element identifies the particular detection method being described. The required Description element is intended to provide some context of how this method can be applied to a specific weakness. The optional Effectiveness element says how effective the detection method may be in detecting the associated weakness. This assumes the use of best-of-breed tools, analysts, and methods. There is limited consideration for financial costs, labor, or time. The optional Effectiveness_Notes element provides additional discussion of the strengths and shortcomings of this detection method.
+//
+// The optional Detection_Method_ID attribute is used by the internal CWE team to uniquely identify methods that are repeated across any number of individual weaknesses. To help make sure that the details of these common methods stay synchronized, the Detection_Method_ID is used to quickly identify those Detection_Method elements across CWE that should be identical. The identifier is a string and should match the following format: DM-1.
+type DetectionMethodsType struct {
+	DetectionMethod []DetectionMethod `xml:"http://cwe.mitre.org/cwe-7 Detection_Method"`
+}
+
+// May be one of High, Moderate, Limited, Incidental, Discouraged Common Practice, Defense in Depth, None
+type EffectivenessEnumeration string
+
+// The ExploitationFactorsType complex type points out conditions or factors that could increase the likelihood of exploit for this weakness.
+type ExploitationFactorsType struct {
+	ExploitationFactor []StructuredTextType `xml:"http://cwe.mitre.org/cwe-7 Exploitation_Factor"`
+}
+
+// The ExternalReferenceType complex type defines a collection of elements that provide a pointer to where more information and deeper insight can be obtained. Examples would be a research paper or an excerpt from a publication.
+//
+// Not all of the elements need to be used, since some are designed for web references and others are designed for book references. The Author and Title elements should be filled out for all references if possible; Author is optional, but Title is required. The optional Edition element identifies the edition of the material being referenced in the event that multiple editions of the material exist. If the reference is part of a magazine or journal, the Publication element should be used to identify the name. The optional Publication_Year, Publication_Month, Publication_Day, and Publisher elements should be used to more specifically identify the book or publication via its date and publisher. The year must follow the YYYY format while the month must follow the --MM format and the day must follow the ---DD format. The URL and URL_Date elements are used to capture a URL for the material being referenced, if one exists, and the date when the URL was validated to exist.
+//
+// The required Reference_ID attribute exists to provide a globally unique identifier for the reference (e.g., REF-1). The ID is used by other entities to link to this external reference.
+type ExternalReferenceType struct {
+	Author           []string  `xml:"http://cwe.mitre.org/cwe-7 Author,omitempty"`
+	Title            string    `xml:"http://cwe.mitre.org/cwe-7 Title"`
+	Edition          string    `xml:"http://cwe.mitre.org/cwe-7 Edition,omitempty"`
+	Publication      string    `xml:"http://cwe.mitre.org/cwe-7 Publication,omitempty"`
+	PublicationYear  time.Time `xml:"http://cwe.mitre.org/cwe-7 Publication_Year,omitempty"`
+	PublicationMonth time.Time `xml:"http://cwe.mitre.org/cwe-7 Publication_Month,omitempty"`
+	PublicationDay   time.Time `xml:"http://cwe.mitre.org/cwe-7 Publication_Day,omitempty"`
+	Publisher        string    `xml:"http://cwe.mitre.org/cwe-7 Publisher,omitempty"`
+	URL              string    `xml:"http://cwe.mitre.org/cwe-7 URL,omitempty"`
+	URLDate          time.Time `xml:"http://cwe.mitre.org/cwe-7 URL_Date,omitempty"`
+	ReferenceID      string    `xml:"Reference_ID,attr"`
+}
+
+func (t *ExternalReferenceType) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	type T ExternalReferenceType
+	var layout struct {
+		*T
+		PublicationYear  *xsdGYear  `xml:"http://cwe.mitre.org/cwe-7 Publication_Year,omitempty"`
+		PublicationMonth *xsdGMonth `xml:"http://cwe.mitre.org/cwe-7 Publication_Month,omitempty"`
+		PublicationDay   *xsdGDay   `xml:"http://cwe.mitre.org/cwe-7 Publication_Day,omitempty"`
+		URLDate          *xsdDate   `xml:"http://cwe.mitre.org/cwe-7 URL_Date,omitempty"`
+	}
+	layout.T = (*T)(t)
+	layout.PublicationYear = (*xsdGYear)(&layout.T.PublicationYear)
+	layout.PublicationMonth = (*xsdGMonth)(&layout.T.PublicationMonth)
+	layout.PublicationDay = (*xsdGDay)(&layout.T.PublicationDay)
+	layout.URLDate = (*xsdDate)(&layout.T.URLDate)
+	return e.EncodeElement(layout, start)
+}
+func (t *ExternalReferenceType) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
+	type T ExternalReferenceType
+	var overlay struct {
+		*T
+		PublicationYear  *xsdGYear  `xml:"http://cwe.mitre.org/cwe-7 Publication_Year,omitempty"`
+		PublicationMonth *xsdGMonth `xml:"http://cwe.mitre.org/cwe-7 Publication_Month,omitempty"`
+		PublicationDay   *xsdGDay   `xml:"http://cwe.mitre.org/cwe-7 Publication_Day,omitempty"`
+		URLDate          *xsdDate   `xml:"http://cwe.mitre.org/cwe-7 URL_Date,omitempty"`
+	}
+	overlay.T = (*T)(t)
+	overlay.PublicationYear = (*xsdGYear)(&overlay.T.PublicationYear)
+	overlay.PublicationMonth = (*xsdGMonth)(&overlay.T.PublicationMonth)
+	overlay.PublicationDay = (*xsdGDay)(&overlay.T.PublicationDay)
+	overlay.URLDate = (*xsdDate)(&overlay.T.URLDate)
+	return d.DecodeElement(&overlay, &start)
+}
+
+type ExternalReferences struct {
+	ExternalReference []ExternalReferenceType `xml:"http://cwe.mitre.org/cwe-7 External_Reference"`
+}
+
+// May be one of Authentication, Authorization, Code Libraries, Counters, Cryptography, Error Handling, Interprocess Communication, File Processing, Logging, Memory Management, Networking, Number Processing, Program Invocation, Protection Mechanism, Session Management, Signals, String Processing, Not Functional-Area-Specific, Power, Clock
+type FunctionalAreaEnumeration string
+
+// The FunctionalAreasType complex type contains one or more functional_area elements, each of which identifies the functional area in which the weakness is most likely to occur. For example, CWE-23: Relative Path Traversal may occur in functional areas of software related to file processing. Each applicable functional area should have a new Functional_Area element, and standard title capitalization should be applied to each area.
+type FunctionalAreasType struct {
+	FunctionalArea []FunctionalAreaEnumeration `xml:"http://cwe.mitre.org/cwe-7 Functional_Area"`
+}
+
+// May be one of Normal, Critical
+type ImportanceEnumeration string
+
+type Introduction struct {
+	Phase PhaseEnumeration   `xml:"http://cwe.mitre.org/cwe-7 Phase"`
+	Note  StructuredTextType `xml:"http://cwe.mitre.org/cwe-7 Note,omitempty"`
+}
+
+type Language struct {
+	Name       LanguageNameEnumeration  `xml:"Name,attr,omitempty"`
+	Class      LanguageClassEnumeration `xml:"Class,attr,omitempty"`
+	Prevalence PrevalenceEnumeration    `xml:"Prevalence,attr"`
+}
+
+// May be one of Assembly, Compiled, Hardware Description Language, Interpreted, Not Language-Specific
+type LanguageClassEnumeration string
+
+// May be one of Ada, ARM Assembly, ASP, ASP.NET, Basic, C, C++, C#, COBOL, Fortran, F#, Go, HTML, Java, JavaScript, JSON, JSP, Objective-C, Pascal, Perl, PHP, Pseudocode, Python, Ruby, Rust, Shell, SQL, Swift, VB.NET, Verilog, VHDL, XML, x86 Assembly, Other
+type LanguageNameEnumeration string
+
+// May be one of High, Medium, Low, Unknown
+type LikelihoodEnumeration string
+
+// The MappingNotesType complex type provides guidance for when (and whether) to map an issue to this CWE entry or to suggest alternatives. The Usage element describes whether the CWE should be used for mapping vulnerabilities to their underlying weaknesses as part of root cause analysis. The Rationale element provides context for the Usage. The Comments element provides further clarification to the reader. The Reasons element uses a limited vocabulary to summarize the Usage. The Suggestions element includes suggestions for additional CWEs that might be more appropriate for the mapping task.
+type MappingNotesType struct {
+	Usage       UsageEnumeration   `xml:"http://cwe.mitre.org/cwe-7 Usage"`
+	Rationale   StructuredTextType `xml:"http://cwe.mitre.org/cwe-7 Rationale"`
+	Comments    StructuredTextType `xml:"http://cwe.mitre.org/cwe-7 Comments"`
+	Reasons     ReasonsType        `xml:"http://cwe.mitre.org/cwe-7 Reasons"`
+	Suggestions SuggestionsType    `xml:"http://cwe.mitre.org/cwe-7 Suggestions,omitempty"`
+}
+
+// The MemberType complex type may be used to establish a Has_Member or Member_Of type relationship within the designated View_ID. This type will establish a relationship between the container Category/View ID and the target CWE_ID.
+type MemberType struct {
+	CWEID  int `xml:"CWE_ID,attr"`
+	ViewID int `xml:"View_ID,attr"`
+}
+
+type Mitigation struct {
+	Phase              []PhaseEnumeration            `xml:"http://cwe.mitre.org/cwe-7 Phase,omitempty"`
+	Strategy           MitigationStrategyEnumeration `xml:"http://cwe.mitre.org/cwe-7 Strategy,omitempty"`
+	Description        StructuredTextType            `xml:"http://cwe.mitre.org/cwe-7 Description"`
+	Effectiveness      EffectivenessEnumeration      `xml:"http://cwe.mitre.org/cwe-7 Effectiveness,omitempty"`
+	EffectivenessNotes StructuredTextType            `xml:"http://cwe.mitre.org/cwe-7 Effectiveness_Notes,omitempty"`
+	MitigationID       string                        `xml:"Mitigation_ID,attr,omitempty"`
+}
+
+// May be one of Attack Surface Reduction, Compilation or Build Hardening, Enforcement by Conversion, Environment Hardening, Firewall, Input Validation, Language Selection, Libraries or Frameworks, Resource Limitation, Output Encoding, Parameterization, Refactoring, Sandbox or Jail, Separation of Privilege
+type MitigationStrategyEnumeration string
+
+// The ModeOfIntroductionType complex type is used to provide information about how and when a given weakness may be introduced. If there are multiple possible introduction points, then a separate Introduction element should be included for each. The required Phase element identifies the point in the product life cycle at which the weakness may be introduced. The optional Note element identifies the typical scenarios under which the weakness may be introduced during the given phase.
+type ModesOfIntroductionType struct {
+	Introduction []Introduction `xml:"http://cwe.mitre.org/cwe-7 Introduction"`
+}
+
+type Modification struct {
+	ModificationName         string                `xml:"http://cwe.mitre.org/cwe-7 Modification_Name,omitempty"`
+	ModificationOrganization string                `xml:"http://cwe.mitre.org/cwe-7 Modification_Organization,omitempty"`
+	ModificationDate         time.Time             `xml:"http://cwe.mitre.org/cwe-7 Modification_Date"`
+	ModificationVersion      string                `xml:"http://cwe.mitre.org/cwe-7 Modification_Version,omitempty"`
+	ModificationReleaseDate  time.Time             `xml:"http://cwe.mitre.org/cwe-7 Modification_ReleaseDate,omitempty"`
+	ModificationImportance   ImportanceEnumeration `xml:"http://cwe.mitre.org/cwe-7 Modification_Importance,omitempty"`
+	ModificationComment      string                `xml:"http://cwe.mitre.org/cwe-7 Modification_Comment,omitempty"`
+}
+
+func (t *Modification) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	type T Modification
+	var layout struct {
+		*T
+		ModificationDate        *xsdDate `xml:"http://cwe.mitre.org/cwe-7 Modification_Date"`
+		ModificationReleaseDate *xsdDate `xml:"http://cwe.mitre.org/cwe-7 Modification_ReleaseDate,omitempty"`
+	}
+	layout.T = (*T)(t)
+	layout.ModificationDate = (*xsdDate)(&layout.T.ModificationDate)
+	layout.ModificationReleaseDate = (*xsdDate)(&layout.T.ModificationReleaseDate)
+	return e.EncodeElement(layout, start)
+}
+func (t *Modification) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
+	type T Modification
+	var overlay struct {
+		*T
+		ModificationDate        *xsdDate `xml:"http://cwe.mitre.org/cwe-7 Modification_Date"`
+		ModificationReleaseDate *xsdDate `xml:"http://cwe.mitre.org/cwe-7 Modification_ReleaseDate,omitempty"`
+	}
+	overlay.T = (*T)(t)
+	overlay.ModificationDate = (*xsdDate)(&overlay.T.ModificationDate)
+	overlay.ModificationReleaseDate = (*xsdDate)(&overlay.T.ModificationReleaseDate)
+	return d.DecodeElement(&overlay, &start)
+}
+
+type Note struct {
+	Items []string            `xml:",any"`
+	Type  NoteTypeEnumeration `xml:"Type,attr"`
+}
+
+// May be one of Applicable Platform, Maintenance, Relationship, Research Gap, Terminology, Theoretical, Other
+type NoteTypeEnumeration string
+
+// The NotesType complex type contains one or more Note elements, each of which is used to provide any additional comments about an entry that cannot be captured using other elements.
+type NotesType struct {
+	Note []Note `xml:"http://cwe.mitre.org/cwe-7 Note"`
+}
+
+type ObservedExample struct {
+	Reference   string             `xml:"http://cwe.mitre.org/cwe-7 Reference"`
+	Description StructuredTextType `xml:"http://cwe.mitre.org/cwe-7 Description"`
+	Link        string             `xml:"http://cwe.mitre.org/cwe-7 Link"`
+}
+
+// The ObservedExampleType complex type specifies references to a specific observed instance of a weakness in real-world products. Typically this will be a CVE reference. Each Observed_Example element represents a single example. The required Reference element should contain the identifier for the example being cited. For example, if a CVE is being cited, it should be of the standard CVE identifier format, such as CVE-2005-1951 or CVE-1999-0046. The required Description element should contain a brief description of the weakness being cited, without including irrelevant details such as the product name or attack vectors. The description should present an unambiguous correlation between the example being described and the weakness(es) that it is meant to exemplify. It should also be short and easy to understand. The Link element should provide a valid URL where more information regarding this example can be obtained.
+type ObservedExampleType struct {
+	ObservedExample []ObservedExample `xml:"http://cwe.mitre.org/cwe-7 Observed_Example"`
+}
+
+type OperatingSystem struct {
+	Name       OperatingSystemNameEnumeration  `xml:"Name,attr,omitempty"`
+	Version    string                          `xml:"Version,attr,omitempty"`
+	CPEID      string                          `xml:"CPE_ID,attr,omitempty"`
+	Class      OperatingSystemClassEnumeration `xml:"Class,attr,omitempty"`
+	Prevalence PrevalenceEnumeration           `xml:"Prevalence,attr"`
+}
+
+// May be one of Linux, macOS, Unix, Windows, Not OS-Specific
+type OperatingSystemClassEnumeration string
+
+// May be one of AIX, Android, BlackBerry OS, Chrome OS, Darwin, FreeBSD, iOS, macOS, NetBSD, OpenBSD, Red Hat, Solaris, SUSE, tvOS, Ubuntu, watchOS, Windows 9x, Windows Embedded, Windows NT
+type OperatingSystemNameEnumeration string
+
+// May be one of Primary
+type OrdinalEnumeration string
+
+// May be one of Indirect, Primary, Resultant
+type OrdinalityEnumeration string
+
+// May be one of Policy, Requirements, Architecture and Design, Implementation, Build and Compilation, Testing, Documentation, Bundling, Distribution, Installation, System Configuration, Operation, Patching and Maintenance, Porting, Integration, Manufacturing, Decommissioning and End-of-Life
+type PhaseEnumeration string
+
+// The PotentialMitigationsType complex type is used to describe potential mitigations associated with a weakness. It contains one or more Mitigation elements, which each represent individual mitigations for the weakness. The Phase element indicates the development life cycle phase during which this particular mitigation may be applied. The Strategy element describes a general strategy for protecting a system to which this mitigation contributes. The Effectiveness element summarizes how effective the mitigation may be in preventing the weakness. The Description element contains a description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness.
+//
+// The optional Mitigation_ID attribute is used by the internal CWE team to uniquely identify mitigations that are repeated across any number of individual weaknesses. To help make sure that the details of these common mitigations stay synchronized, the Mitigation_ID is used to quickly identify those mitigation elements across CWE that should be identical. The identifier is a string and should match the following format: MIT-1.
+type PotentialMitigationsType struct {
+	Mitigation []Mitigation `xml:"http://cwe.mitre.org/cwe-7 Mitigation"`
+}
+
+// May be one of Often, Sometimes, Rarely, Undetermined
+type PrevalenceEnumeration string
+
+type PreviousEntryName struct {
+	Value   string    `xml:",chardata"`
+	Date    time.Time `xml:"Date,attr"`
+	Version string    `xml:"Version,attr,omitempty"`
+}
+
+func (t *PreviousEntryName) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	type T PreviousEntryName
+	var layout struct {
+		*T
+		Date *xsdDate `xml:"Date,attr"`
+	}
+	layout.T = (*T)(t)
+	layout.Date = (*xsdDate)(&layout.T.Date)
+	return e.EncodeElement(layout, start)
+}
+func (t *PreviousEntryName) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
+	type T PreviousEntryName
+	var overlay struct {
+		*T
+		Date *xsdDate `xml:"Date,attr"`
+	}
+	overlay.T = (*T)(t)
+	overlay.Date = (*xsdDate)(&overlay.T.Date)
+	return d.DecodeElement(&overlay, &start)
+}
+
+type Reason struct {
+	Type ReasonEnumeration `xml:"Type,attr"`
+}
+
+// May be one of Abstraction, Category, View, Deprecated, Potential Deprecation, Frequent Misuse, Frequent Misinterpretation, Multiple Use, CWE Overlap, Acceptable-Use, Potential Major Changes, Other
+type ReasonEnumeration string
+
+// The ReasonsType complex type is used to identify the different reasons to why a CWE should not be considered.
+type ReasonsType struct {
+	Reason []Reason `xml:"http://cwe.mitre.org/cwe-7 Reason"`
+}
+
+type Reference struct {
+	ExternalReferenceID string `xml:"External_Reference_ID,attr"`
+	Section             string `xml:"Section,attr,omitempty"`
+}
+
+// The ReferencesType complex type contains one or more reference elements, each of which is used to link to an external reference defined within the catalog. The required External_Reference_ID attribute represents the external reference entry being linked to (e.g., REF-1). Text or quotes within the same CWE entity can cite this External_Reference_ID similar to how a footnote is used, and should use the format [REF-1]. The optional Section attribute holds any section title or page number that is specific to this use of the reference.
+type ReferencesType struct {
+	Reference []Reference `xml:"http://cwe.mitre.org/cwe-7 Reference"`
+}
+
+type RelatedAttackPattern struct {
+	CAPECID int `xml:"CAPEC_ID,attr"`
+}
+
+// The RelatedAttackPatternsType complex type contains references to attack patterns associated with this weakness. The association implies those attack patterns may be applicable if an instance of this weakness exists. Each related attack pattern is identified by a CAPEC identifier.
+type RelatedAttackPatternsType struct {
+	RelatedAttackPattern []RelatedAttackPattern `xml:"http://cwe.mitre.org/cwe-7 Related_Attack_Pattern"`
+}
+
+// May be one of ChildOf, ParentOf, StartsWith, CanFollow, CanPrecede, RequiredBy, Requires, CanAlsoBe, PeerOf
+type RelatedNatureEnumeration string
+
+type RelatedWeakness struct {
+	Nature  RelatedNatureEnumeration `xml:"Nature,attr"`
+	CWEID   int                      `xml:"CWE_ID,attr"`
+	ViewID  int                      `xml:"View_ID,attr"`
+	ChainID int                      `xml:"Chain_ID,attr,omitempty"`
+	Ordinal OrdinalEnumeration       `xml:"Ordinal,attr,omitempty"`
+}
+
+// The RelatedWeaknessesType complex type is used to refer to other weaknesses that differ only in their level of abstraction. It contains one or more Related_Weakness elements, each of which is used to link to the CWE identifier of the other Weakness. The nature of the relation is captured by the Nature attribute. Please see the RelatedNatureEnumeration simple type definition for details about the valid value and meanings. The optional Chain_ID attribute specifies the unique ID of a named chain that a CanFollow or CanPrecede relationship pertains to. The optional Ordinal attribute is used to determine if this relationship is the primary ChildOf relationship for this weakness for a given View_ID. This attribute can only have the value "Primary" and should only be included for the primary parent/child relationship. For each unique triple of <Nature, CWE_ID, View_ID>, there should be only one relationship that is given a "Primary" ordinal.
+type RelatedWeaknessesType struct {
+	RelatedWeakness []RelatedWeakness `xml:"http://cwe.mitre.org/cwe-7 Related_Weakness"`
+}
+
+// The RelationshipsType complex type provides elements to show the associated relationships with a given view or category. The Member_Of element is used to denote the individual categories that are included as part of the target view. The Has_Member element is used to define the weaknesses or other categories that are grouped together by a category. In both cases, the required MemberType's CWE_ID attribute specifies the unique CWE ID that is the target entry of the relationship, while the View_ID specifies which view the given relationship is relevant to.
+type RelationshipsType struct {
+	MemberOf  []MemberType `xml:"http://cwe.mitre.org/cwe-7 Member_Of,omitempty"`
+	HasMember []MemberType `xml:"http://cwe.mitre.org/cwe-7 Has_Member,omitempty"`
+}
+
+// May be one of CPU, File or Directory, Memory, System Process, Other
+type ResourceEnumeration string
 
 // May be one of Confidentiality, Integrity, Availability, Access Control, Accountability, Authentication, Authorization, Non-Repudiation, Other
 type ScopeEnumeration string
+
+type Stakeholder struct {
+	Type        StakeholderEnumeration `xml:"http://cwe.mitre.org/cwe-7 Type"`
+	Description string                 `xml:"http://cwe.mitre.org/cwe-7 Description,omitempty"`
+}
+
+// May be one of Academic Researchers, Applied Researchers, Assessment Teams, Assessment Tool Vendors, CWE Team, Educators, Hardware Designers, Information Providers, Product Customers, Product Vendors, Software Developers, Vulnerability Analysts, Other
+type StakeholderEnumeration string
+
+// May be one of Deprecated, Draft, Incomplete, Obsolete, Stable, Usable
+type StatusEnumeration string
+
+// May be one of Chain, Composite, Simple
+type StructureEnumeration string
+
+// May be one of Attack, Bad, Good, Informative, Mitigation, Result
+type StructuredCodeNatureEnumeration string
+
+// The StructuredCodeType complex type is used to present source code examples and other structured text that is not a regular paragraph. It allows embedded XHTML content to enable formatting of the code. The required Nature attribute states what type of code the example shows.  The optional Language attribute states which source code language is used in the example. This is mostly appropriate when the Nature is "good" or "bad".
+type StructuredCodeType struct {
+	Items    []string                        `xml:",any"`
+	Language LanguageNameEnumeration         `xml:"Language,attr,omitempty"`
+	Nature   StructuredCodeNatureEnumeration `xml:"Nature,attr"`
+}
+
+// The StructuredTextType complex type is used to allow XHTML content embedded within standard string data. Some common elements are: <BR/> to insert a line break, <UL><LI/></UL> to create a bulleted list, <OL><LI/></OL> to create a numbered list, and <DIV style="margin-left: 40px"></DIV> to create a new indented section.
 type StructuredTextType []string
 
 func (a StructuredTextType) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
 	var output struct {
 		ArrayType string   `xml:"http://schemas.xmlsoap.org/wsdl/ arrayType,attr"`
-		Items     []string `xml:"item"`
+		Items     []string `xml:" item"`
 	}
 	output.Items = []string(a)
-	start.Attr = append(start.Attr, xml.Attr{Name: xml.Name{Space: " ", Local: "xmlns:ns1"}, Value: "http://www.w3.org/2001/XMLSchema"})
+	start.Attr = append(start.Attr, xml.Attr{Name: xml.Name{"", "xmlns:ns1"}, Value: "http://www.w3.org/2001/XMLSchema"})
 	output.ArrayType = "ns1:anyType[]"
 	return e.EncodeElement(&output, start)
 }
@@ -80,37 +532,309 @@ func (a *StructuredTextType) UnmarshalXML(d *xml.Decoder, start xml.StartElement
 	return err
 }
 
+type Submission struct {
+	SubmissionName         string    `xml:"http://cwe.mitre.org/cwe-7 Submission_Name,omitempty"`
+	SubmissionOrganization string    `xml:"http://cwe.mitre.org/cwe-7 Submission_Organization,omitempty"`
+	SubmissionDate         time.Time `xml:"http://cwe.mitre.org/cwe-7 Submission_Date"`
+	SubmissionVersion      string    `xml:"http://cwe.mitre.org/cwe-7 Submission_Version"`
+	SubmissionReleaseDate  time.Time `xml:"http://cwe.mitre.org/cwe-7 Submission_ReleaseDate"`
+	SubmissionComment      string    `xml:"http://cwe.mitre.org/cwe-7 Submission_Comment,omitempty"`
+}
+
+func (t *Submission) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	type T Submission
+	var layout struct {
+		*T
+		SubmissionDate        *xsdDate `xml:"http://cwe.mitre.org/cwe-7 Submission_Date"`
+		SubmissionReleaseDate *xsdDate `xml:"http://cwe.mitre.org/cwe-7 Submission_ReleaseDate"`
+	}
+	layout.T = (*T)(t)
+	layout.SubmissionDate = (*xsdDate)(&layout.T.SubmissionDate)
+	layout.SubmissionReleaseDate = (*xsdDate)(&layout.T.SubmissionReleaseDate)
+	return e.EncodeElement(layout, start)
+}
+func (t *Submission) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
+	type T Submission
+	var overlay struct {
+		*T
+		SubmissionDate        *xsdDate `xml:"http://cwe.mitre.org/cwe-7 Submission_Date"`
+		SubmissionReleaseDate *xsdDate `xml:"http://cwe.mitre.org/cwe-7 Submission_ReleaseDate"`
+	}
+	overlay.T = (*T)(t)
+	overlay.SubmissionDate = (*xsdDate)(&overlay.T.SubmissionDate)
+	overlay.SubmissionReleaseDate = (*xsdDate)(&overlay.T.SubmissionReleaseDate)
+	return d.DecodeElement(&overlay, &start)
+}
+
+type Suggestion struct {
+	CWEID   int    `xml:"CWE_ID,attr"`
+	Comment string `xml:"Comment,attr"`
+}
+
+// The SuggestionsType complex type is used to suggest other CWE entries that might be more appropriate to use for mapping.
+type SuggestionsType struct {
+	Suggestion []Suggestion `xml:"http://cwe.mitre.org/cwe-7 Suggestion"`
+}
+
+type TaxonomyMapping struct {
+	EntryID      string                        `xml:"http://cwe.mitre.org/cwe-7 Entry_ID,omitempty"`
+	EntryName    string                        `xml:"http://cwe.mitre.org/cwe-7 Entry_Name,omitempty"`
+	MappingFit   TaxonomyMappingFitEnumeration `xml:"http://cwe.mitre.org/cwe-7 Mapping_Fit,omitempty"`
+	TaxonomyName TaxonomyNameEnumeration       `xml:"Taxonomy_Name,attr"`
+}
+
+// May be one of Exact, CWE More Abstract, CWE More Specific, Imprecise, Perspective
+type TaxonomyMappingFitEnumeration string
+
+// The TaxonomyMappingsType complex type is used to provide a mapping from an entry (Weakness or Category) in CWE to an equivalent entry in a different taxonomy. The required Taxonomy_Name attribute identifies the taxonomy to which the mapping is being made. The Entry_ID and Entry_Name elements identify the ID and name of the entry which is being mapped. The Mapping_Fit element identifies how close the CWE is to the entry in the taxonomy.
+type TaxonomyMappingsType struct {
+	TaxonomyMapping []TaxonomyMapping `xml:"http://cwe.mitre.org/cwe-7 Taxonomy_Mapping"`
+}
+
+// May be one of 7 Pernicious Kingdoms, 19 Deadly Sins, Aslam, Bishop, CERT C Secure Coding, CERT C++ Secure Coding, The CERT Oracle Secure Coding Standard for Java (2011), CLASP, ISA/IEC 62443, Landwehr, OMG ASCSM, OMG ASCRM, OMG ASCMM, OMG ASCPEM, OWASP Top Ten 2004, OWASP Top Ten 2007, OWASP Top Ten, PLOVER, Protection Analysis, RISOS, SEI CERT C Coding Standard, SEI CERT C++ Coding Standard, SEI CERT Oracle Coding Standard for Java, SEI CERT Perl Coding Standard, Software Fault Patterns, Weber, Karger, Paradkar, WASC
+type TaxonomyNameEnumeration string
+
+// May be one of Modify Memory, Read Memory, Modify Files or Directories, Read Files or Directories, Modify Application Data, Read Application Data, DoS: Crash, Exit, or Restart, DoS: Amplification, DoS: Instability, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other), Execute Unauthorized Code or Commands, Gain Privileges or Assume Identity, Bypass Protection Mechanism, Hide Activities, Alter Execution Logic, Quality Degradation, Unexpected State, Varies by Context, Reduce Maintainability, Reduce Performance, Reduce Reliability, Other
+type TechnicalImpactEnumeration string
+
+type Technology struct {
+	Name       TechnologyNameEnumeration  `xml:"Name,attr,omitempty"`
+	Class      TechnologyClassEnumeration `xml:"Class,attr,omitempty"`
+	Prevalence PrevalenceEnumeration      `xml:"Prevalence,attr"`
+}
+
+// May be one of Client Server, Cloud Computing, ICS/OT, Mainframe, Mobile, N-Tier, SOA, System on Chip, Web Based, Not Technology-Specific
+type TechnologyClassEnumeration string
+
+// May be one of AI/ML, Web Server, Database Server, Accelerator Hardware, Analog and Mixed Signal Hardware, Audio/Video Hardware, Bus/Interface Hardware, Clock/Counter Hardware, Communication Hardware, Controller Hardware, Memory Hardware, Microcontroller Hardware, Network on Chip Hardware, Power Management Hardware, Processor Hardware, Security Hardware, Sensor Hardware, Storage Hardware, Test/Debug Hardware, Other
+type TechnologyNameEnumeration string
+
+// May be one of Content, Feedback
+type Type string
+
+// May be one of Discouraged, Prohibited, Allowed, Allowed-with-Review
+type UsageEnumeration string
+
+// A view represents a perspective with which one might look at the weaknesses in the catalog. There are three different types of views as defined by the type attribute: graphs, explicit slices, and implicit slices. The members of a view are either defined externally through the members element (in the case of a graph or an explicit slice) or by the optional filter element (in the case of an implicit slice).
+//
+// The required Objective element describes the perspective from which the view has been constructed. The optional Audience element provides a reference to the target stakeholders or groups for whom the view is most relevant. The optional Members element is used to define Member_Of relationships with categories. The optional Filter element is only used for implicit slices (see the Type attribute) and holds an XSL query for identifying which entries are members of the view. The optional References element is used to provide further reading and insight into this view. This element should be used when the view is based on external sources or projects. The optional Notes element is used to provide any additional comments that cannot be captured using the other elements of the view. The optional Content_History element is used to keep track of the original author of the view and any subsequent modifications to the content. This provides a means of contacting the authors and modifiers for clarifying ambiguities, or in merging overlapping contributions.
+//
+// The required ID attribute provides a unique identifier for the view. It is meant to be static for the lifetime of the view. If the view becomes deprecated, the ID should not be reused, and a placeholder for the deprecated view should be left in the catalog. The required Name attribute provides a descriptive title used to give the reader an idea of what perspective this view represents. All words in the name should be capitalized except for articles and prepositions, unless they begin or end the name. The required Type attribute describes how this view is being constructed. Please refer to the ViewTypeEnumeration simple type for a list of valid values and their meanings. The required Status attribute defines the maturity of the information for this view. Please refer to the StatusEnumeration simple type for a list of valid values and their meanings.
+type ViewType struct {
+	Objective      StructuredTextType  `xml:"http://cwe.mitre.org/cwe-7 Objective"`
+	Audience       AudienceType        `xml:"http://cwe.mitre.org/cwe-7 Audience,omitempty"`
+	Members        RelationshipsType   `xml:"http://cwe.mitre.org/cwe-7 Members,omitempty"`
+	Filter         string              `xml:"http://cwe.mitre.org/cwe-7 Filter,omitempty"`
+	References     ReferencesType      `xml:"http://cwe.mitre.org/cwe-7 References,omitempty"`
+	MappingNotes   MappingNotesType    `xml:"http://cwe.mitre.org/cwe-7 Mapping_Notes"`
+	Notes          NotesType           `xml:"http://cwe.mitre.org/cwe-7 Notes,omitempty"`
+	ContentHistory ContentHistoryType  `xml:"http://cwe.mitre.org/cwe-7 Content_History"`
+	ID             int                 `xml:"ID,attr"`
+	Name           string              `xml:"Name,attr"`
+	Type           ViewTypeEnumeration `xml:"Type,attr"`
+	Status         StatusEnumeration   `xml:"Status,attr"`
+}
+
+// May be one of Implicit, Explicit, Graph
+type ViewTypeEnumeration string
+
+type Views struct {
+	View []ViewType `xml:"http://cwe.mitre.org/cwe-7 View"`
+}
+
 type WeaknessCatalog struct {
-	Weaknesses Weaknesses `xml:"http://cwe.mitre.org/cwe-6 Weaknesses,omitempty"`
+	Weaknesses         Weaknesses         `xml:"http://cwe.mitre.org/cwe-7 Weaknesses,omitempty"`
+	Categories         Categories         `xml:"http://cwe.mitre.org/cwe-7 Categories,omitempty"`
+	Views              Views              `xml:"http://cwe.mitre.org/cwe-7 Views,omitempty"`
+	ExternalReferences ExternalReferences `xml:"http://cwe.mitre.org/cwe-7 External_References,omitempty"`
+	Name               string             `xml:"Name,attr"`
+	Version            string             `xml:"Version,attr"`
+	Date               time.Time          `xml:"Date,attr"`
 }
 
 func (t *WeaknessCatalog) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
 	type T WeaknessCatalog
 	var layout struct {
 		*T
+		Date *xsdDate `xml:"Date,attr"`
 	}
 	layout.T = (*T)(t)
+	layout.Date = (*xsdDate)(&layout.T.Date)
 	return e.EncodeElement(layout, start)
 }
 func (t *WeaknessCatalog) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error {
 	type T WeaknessCatalog
 	var overlay struct {
 		*T
+		Date *xsdDate `xml:"Date,attr"`
 	}
 	overlay.T = (*T)(t)
+	overlay.Date = (*xsdDate)(&overlay.T.Date)
 	return d.DecodeElement(&overlay, &start)
 }
 
+// The WeaknessOrdinalitiesType complex type indicates potential ordering relationships with other weaknesses. The required Ordinality element identifies whether the weakness has a primary, resultant, or indirect relationship. The optional Description contains the context in which the relationship exists. It is important to note that it is possible for the same entry to be primary in some instances and resultant in others.
+type WeaknessOrdinalitiesType struct {
+	WeaknessOrdinality []WeaknessOrdinality `xml:"http://cwe.mitre.org/cwe-7 Weakness_Ordinality"`
+}
+
+type WeaknessOrdinality struct {
+	Ordinality  OrdinalityEnumeration `xml:"http://cwe.mitre.org/cwe-7 Ordinality"`
+	Description string                `xml:"http://cwe.mitre.org/cwe-7 Description,omitempty"`
+}
+
+// A weakness is a mistake or condition that, if left unaddressed, could under the proper conditions contribute to a cyber-enabled capability being vulnerable to attack, allowing an adversary to make items function in unintended ways. This complexType is used to describe a specific type of weakness and provide a variety of information related to it.
+//
+// The required Description should be short and limited to the key points that define this weakness. The optional Extended_Description element provides a place for additional details important to this weakness, but that are not necessary to convey the fundamental concept behind the weakness. A number of other optional elements are available, each of which is described in more detail within the corresponding complexType that it references.
+//
+// The required ID attribute provides a unique identifier for the entry. It is considered static for the lifetime of the entry. If this entry becomes deprecated, the identifier will not be reused. The required Name attribute is a string that identifies the entry. The name should focus on the weakness being described and should avoid mentioning the attack that exploits the weakness or the consequences of exploiting the weakness. All words in the entry name should be capitalized except for articles and prepositions, unless they begin or end the name. Subsequent words in a hyphenated chain are also not capitalized. The required Abstraction attribute defines the abstraction level for this weakness. The required Structure attribute defines the structural nature of the weakness. The required Status attribute defines the maturity of the information for this weakness.
 type WeaknessType struct {
+	Description           string                    `xml:"http://cwe.mitre.org/cwe-7 Description"`
+	ExtendedDescription   StructuredTextType        `xml:"http://cwe.mitre.org/cwe-7 Extended_Description,omitempty"`
+	RelatedWeaknesses     RelatedWeaknessesType     `xml:"http://cwe.mitre.org/cwe-7 Related_Weaknesses,omitempty"`
+	WeaknessOrdinalities  WeaknessOrdinalitiesType  `xml:"http://cwe.mitre.org/cwe-7 Weakness_Ordinalities,omitempty"`
+	ApplicablePlatforms   ApplicablePlatformsType   `xml:"http://cwe.mitre.org/cwe-7 Applicable_Platforms,omitempty"`
+	BackgroundDetails     BackgroundDetailsType     `xml:"http://cwe.mitre.org/cwe-7 Background_Details,omitempty"`
+	AlternateTerms        AlternateTermsType        `xml:"http://cwe.mitre.org/cwe-7 Alternate_Terms,omitempty"`
+	ModesOfIntroduction   ModesOfIntroductionType   `xml:"http://cwe.mitre.org/cwe-7 Modes_Of_Introduction,omitempty"`
+	ExploitationFactors   ExploitationFactorsType   `xml:"http://cwe.mitre.org/cwe-7 Exploitation_Factors,omitempty"`
+	LikelihoodOfExploit   LikelihoodEnumeration     `xml:"http://cwe.mitre.org/cwe-7 Likelihood_Of_Exploit,omitempty"`
+	CommonConsequences    CommonConsequencesType    `xml:"http://cwe.mitre.org/cwe-7 Common_Consequences,omitempty"`
+	DetectionMethods      DetectionMethodsType      `xml:"http://cwe.mitre.org/cwe-7 Detection_Methods,omitempty"`
+	PotentialMitigations  PotentialMitigationsType  `xml:"http://cwe.mitre.org/cwe-7 Potential_Mitigations,omitempty"`
+	DemonstrativeExamples DemonstrativeExamplesType `xml:"http://cwe.mitre.org/cwe-7 Demonstrative_Examples,omitempty"`
+	ObservedExamples      ObservedExampleType       `xml:"http://cwe.mitre.org/cwe-7 Observed_Examples,omitempty"`
+	FunctionalAreas       FunctionalAreasType       `xml:"http://cwe.mitre.org/cwe-7 Functional_Areas,omitempty"`
+	AffectedResources     AffectedResourcesType     `xml:"http://cwe.mitre.org/cwe-7 Affected_Resources,omitempty"`
+	TaxonomyMappings      TaxonomyMappingsType      `xml:"http://cwe.mitre.org/cwe-7 Taxonomy_Mappings,omitempty"`
+	RelatedAttackPatterns RelatedAttackPatternsType `xml:"http://cwe.mitre.org/cwe-7 Related_Attack_Patterns,omitempty"`
+	References            ReferencesType            `xml:"http://cwe.mitre.org/cwe-7 References,omitempty"`
+	MappingNotes          MappingNotesType          `xml:"http://cwe.mitre.org/cwe-7 Mapping_Notes"`
+	Notes                 NotesType                 `xml:"http://cwe.mitre.org/cwe-7 Notes,omitempty"`
+	ContentHistory        ContentHistoryType        `xml:"http://cwe.mitre.org/cwe-7 Content_History"`
 	ID                    int                       `xml:"ID,attr"`
 	Name                  string                    `xml:"Name,attr"`
-	Description           string                    `xml:"http://cwe.mitre.org/cwe-6 Description"`
-	PotentialMitigations  PotentialMitigationsType  `xml:"http://cwe.mitre.org/cwe-6 Potential_Mitigations,omitempty"`
-	RelatedAttackPatterns RelatedAttackPatternsType `xml:"http://cwe.mitre.org/cwe-6 Related_Attack_Patterns,omitempty"`
-	CommonConsequences    CommonConsequencesType    `xml:"http://cwe.mitre.org/cwe-6 Common_Consequences,omitempty"`
-	ExtendedDescription   StructuredTextType        `xml:"http://cwe.mitre.org/cwe-6 Extended_Description,omitempty"`
+	Abstraction           AbstractionEnumeration    `xml:"Abstraction,attr"`
+	Structure             StructureEnumeration      `xml:"Structure,attr"`
+	Status                StatusEnumeration         `xml:"Status,attr"`
+	Diagram               string                    `xml:"Diagram,attr,omitempty"`
 }
 
 type Weaknesses struct {
-	Weakness []WeaknessType `xml:"http://cwe.mitre.org/cwe-6 Weakness"`
+	Weakness []WeaknessType `xml:"http://cwe.mitre.org/cwe-7 Weakness"`
+}
+
+type xsdDate time.Time
+
+func (t *xsdDate) UnmarshalText(text []byte) error {
+	return _unmarshalTime(text, (*time.Time)(t), "2006-01-02")
+}
+func (t xsdDate) MarshalText() ([]byte, error) {
+	return _marshalTime((time.Time)(t), "2006-01-02")
+}
+func (t xsdDate) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	if (time.Time)(t).IsZero() {
+		return nil
+	}
+	m, err := t.MarshalText()
+	if err != nil {
+		return err
+	}
+	return e.EncodeElement(m, start)
+}
+func (t xsdDate) MarshalXMLAttr(name xml.Name) (xml.Attr, error) {
+	if (time.Time)(t).IsZero() {
+		return xml.Attr{}, nil
+	}
+	m, err := t.MarshalText()
+	return xml.Attr{Name: name, Value: string(m)}, err
+}
+func _unmarshalTime(text []byte, t *time.Time, format string) (err error) {
+	s := string(bytes.TrimSpace(text))
+	*t, err = time.Parse(format, s)
+	if _, ok := err.(*time.ParseError); ok {
+		*t, err = time.Parse(format+"Z07:00", s)
+	}
+	return err
+}
+func _marshalTime(t time.Time, format string) ([]byte, error) {
+	return []byte(t.Format(format + "Z07:00")), nil
+}
+
+type xsdGDay time.Time
+
+func (t *xsdGDay) UnmarshalText(text []byte) error {
+	return _unmarshalTime(text, (*time.Time)(t), "---02")
+}
+func (t xsdGDay) MarshalText() ([]byte, error) {
+	return _marshalTime((time.Time)(t), "---02")
+}
+func (t xsdGDay) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	if (time.Time)(t).IsZero() {
+		return nil
+	}
+	m, err := t.MarshalText()
+	if err != nil {
+		return err
+	}
+	return e.EncodeElement(m, start)
+}
+func (t xsdGDay) MarshalXMLAttr(name xml.Name) (xml.Attr, error) {
+	if (time.Time)(t).IsZero() {
+		return xml.Attr{}, nil
+	}
+	m, err := t.MarshalText()
+	return xml.Attr{Name: name, Value: string(m)}, err
+}
+
+type xsdGMonth time.Time
+
+func (t *xsdGMonth) UnmarshalText(text []byte) error {
+	return _unmarshalTime(text, (*time.Time)(t), "--01")
+}
+func (t xsdGMonth) MarshalText() ([]byte, error) {
+	return _marshalTime((time.Time)(t), "--01")
+}
+func (t xsdGMonth) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	if (time.Time)(t).IsZero() {
+		return nil
+	}
+	m, err := t.MarshalText()
+	if err != nil {
+		return err
+	}
+	return e.EncodeElement(m, start)
+}
+func (t xsdGMonth) MarshalXMLAttr(name xml.Name) (xml.Attr, error) {
+	if (time.Time)(t).IsZero() {
+		return xml.Attr{}, nil
+	}
+	m, err := t.MarshalText()
+	return xml.Attr{Name: name, Value: string(m)}, err
+}
+
+type xsdGYear time.Time
+
+func (t *xsdGYear) UnmarshalText(text []byte) error {
+	return _unmarshalTime(text, (*time.Time)(t), "2006")
+}
+func (t xsdGYear) MarshalText() ([]byte, error) {
+	return _marshalTime((time.Time)(t), "2006")
+}
+func (t xsdGYear) MarshalXML(e *xml.Encoder, start xml.StartElement) error {
+	if (time.Time)(t).IsZero() {
+		return nil
+	}
+	m, err := t.MarshalText()
+	if err != nil {
+		return err
+	}
+	return e.EncodeElement(m, start)
+}
+func (t xsdGYear) MarshalXMLAttr(name xml.Name) (xml.Attr, error) {
+	if (time.Time)(t).IsZero() {
+		return xml.Attr{}, nil
+	}
+	m, err := t.MarshalText()
+	return xml.Attr{Name: name, Value: string(m)}, err
 }
diff --git a/cwe/goldens/good-small-cwe.json b/cwe/goldens/good-small-cwe.json
index a6bb5c1..4a614a5 100644
--- a/cwe/goldens/good-small-cwe.json
+++ b/cwe/goldens/good-small-cwe.json
@@ -1,7 +1,158 @@
 {
  "ID": 209,
  "Name": "Generation of Error Message Containing Sensitive Information",
- "Description": "The software generates an error message that includes sensitive information about its environment, users, or associated data.",
+ "Description": "The product generates an error message that includes sensitive information about its environment, users, or associated data.",
+ "Abstraction": "Base",
+ "Structure": "Simple",
+ "Status": "Draft",
+ "Diagram": "/data/images/CWE-209-Diagram.png",
+ "ExtendedDescription": null,
+ "RelatedWeaknesses": {
+  "RelatedWeakness": [
+   {
+    "Nature": "ChildOf",
+    "CWEID": 200,
+    "ViewID": 1000,
+    "ChainID": 0,
+    "Ordinal": "Primary"
+   },
+   {
+    "Nature": "ChildOf",
+    "CWEID": 200,
+    "ViewID": 1003,
+    "ChainID": 0,
+    "Ordinal": "Primary"
+   },
+   {
+    "Nature": "ChildOf",
+    "CWEID": 755,
+    "ViewID": 1000,
+    "ChainID": 0,
+    "Ordinal": ""
+   }
+  ]
+ },
+ "WeaknessOrdinalities": {
+  "WeaknessOrdinality": [
+   {
+    "Ordinality": "Primary",
+    "Description": ""
+   },
+   {
+    "Ordinality": "Resultant",
+    "Description": ""
+   }
+  ]
+ },
+ "ApplicablePlatforms": {
+  "Language": [
+   {
+    "Name": "PHP",
+    "Class": "",
+    "Prevalence": "Often"
+   },
+   {
+    "Name": "Java",
+    "Class": "",
+    "Prevalence": "Often"
+   },
+   {
+    "Name": "",
+    "Class": "Not Language-Specific",
+    "Prevalence": "Undetermined"
+   }
+  ],
+  "OperatingSystem": null,
+  "Architecture": null,
+  "Technology": null
+ },
+ "BackgroundDetails": {
+  "BackgroundDetail": null
+ },
+ "AlternateTerms": {
+  "AlternateTerm": null
+ },
+ "ModesOfIntroduction": {
+  "Introduction": [
+   {
+    "Phase": "Architecture and Design",
+    "Note": null
+   },
+   {
+    "Phase": "Implementation",
+    "Note": null
+   },
+   {
+    "Phase": "System Configuration",
+    "Note": null
+   },
+   {
+    "Phase": "Operation",
+    "Note": null
+   }
+  ]
+ },
+ "ExploitationFactors": {
+  "ExploitationFactor": null
+ },
+ "LikelihoodOfExploit": "High",
+ "CommonConsequences": {
+  "Consequence": [
+   {
+    "Scope": [
+     "Confidentiality"
+    ],
+    "Impact": [
+     "Read Application Data"
+    ],
+    "Likelihood": "",
+    "Note": null,
+    "ConsequenceID": ""
+   }
+  ]
+ },
+ "DetectionMethods": {
+  "DetectionMethod": [
+   {
+    "Method": "Manual Analysis",
+    "Description": null,
+    "Effectiveness": "High",
+    "EffectivenessNotes": null,
+    "DetectionMethodID": ""
+   },
+   {
+    "Method": "Automated Analysis",
+    "Description": null,
+    "Effectiveness": "Moderate",
+    "EffectivenessNotes": null,
+    "DetectionMethodID": ""
+   },
+   {
+    "Method": "Automated Dynamic Analysis",
+    "Description": [
+     "This weakness can be detected using dynamic tools and techniques that interact with the software using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The software's operation may slow down, but it should not become unstable, crash, or generate incorrect results.",
+     "Error conditions may be triggered with a stress-test by calling the software simultaneously from a large number of threads or processes, and look for evidence of any unexpected behavior."
+    ],
+    "Effectiveness": "Moderate",
+    "EffectivenessNotes": null,
+    "DetectionMethodID": "DM-2"
+   },
+   {
+    "Method": "Manual Dynamic Analysis",
+    "Description": null,
+    "Effectiveness": "",
+    "EffectivenessNotes": null,
+    "DetectionMethodID": "DM-12"
+   },
+   {
+    "Method": "Automated Static Analysis",
+    "Description": null,
+    "Effectiveness": "",
+    "EffectivenessNotes": null,
+    "DetectionMethodID": "DM-14"
+   }
+  ]
+ },
  "PotentialMitigations": {
   "Mitigation": [
    {
@@ -10,23 +161,33 @@
     ],
     "Strategy": "",
     "Description": [
-     "Ensure that error messages only contain minimal details that are useful to the intended audience, and nobody else. The messages need to strike the balance between being too cryptic and not being cryptic enough. They should not necessarily reveal the methods that were used to determine the error. Such detailed information can be used to refine the original attack to increase the chances of success.",
-     "If errors must be tracked in some detail, capture them in log messages - but consider what could occur if the log messages can be viewed by attackers. Avoid recording highly sensitive information such as passwords in any form. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a username is valid or not."
-    ]
+     "Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.",
+     "If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.",
+     "Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not."
+    ],
+    "Effectiveness": "",
+    "EffectivenessNotes": null,
+    "MitigationID": "MIT-39"
    },
    {
     "Phase": [
      "Implementation"
     ],
     "Strategy": "",
-    "Description": null
+    "Description": null,
+    "Effectiveness": "",
+    "EffectivenessNotes": null,
+    "MitigationID": ""
    },
    {
     "Phase": [
      "Implementation"
     ],
     "Strategy": "Attack Surface Reduction",
-    "Description": null
+    "Description": null,
+    "Effectiveness": "Defense in Depth",
+    "EffectivenessNotes": null,
+    "MitigationID": "MIT-33"
    },
    {
     "Phase": [
@@ -34,7 +195,10 @@
      "Build and Compilation"
     ],
     "Strategy": "Compilation or Build Hardening",
-    "Description": null
+    "Description": null,
+    "Effectiveness": "",
+    "EffectivenessNotes": null,
+    "MitigationID": "MIT-40"
    },
    {
     "Phase": [
@@ -42,29 +206,198 @@
      "Build and Compilation"
     ],
     "Strategy": "Environment Hardening",
-    "Description": null
+    "Description": null,
+    "Effectiveness": "",
+    "EffectivenessNotes": null,
+    "MitigationID": "MIT-40"
    },
    {
     "Phase": [
      "System Configuration"
     ],
     "Strategy": "",
-    "Description": null
+    "Description": null,
+    "Effectiveness": "",
+    "EffectivenessNotes": null,
+    "MitigationID": ""
    },
    {
     "Phase": [
      "System Configuration"
     ],
     "Strategy": "",
-    "Description": null
+    "Description": null,
+    "Effectiveness": "",
+    "EffectivenessNotes": null,
+    "MitigationID": ""
    }
   ]
  },
- "RelatedAttackPatterns": {
-  "RelatedAttackPattern": [
+ "DemonstrativeExamples": {
+  "DemonstrativeExample": [
+   {
+    "TitleText": "",
+    "IntroText": null,
+    "BodyText": null,
+    "ExampleCode": {
+     "Items": [
+      "try {}catch (Exception e) {}"
+     ],
+     "Language": "Java",
+     "Nature": "Bad"
+    },
+    "References": {
+     "Reference": null
+    },
+    "DemonstrativeExampleID": ""
+   },
+   {
+    "TitleText": "",
+    "IntroText": null,
+    "BodyText": null,
+    "ExampleCode": {
+     "Items": [
+      "try {}\n                            \n                            catch (Exception $e) {}"
+     ],
+     "Language": "PHP",
+     "Nature": "Bad"
+    },
+    "References": {
+     "Reference": null
+    },
+    "DemonstrativeExampleID": "DX-118"
+   },
    {
-    "CAPECID": 214
+    "TitleText": "",
+    "IntroText": null,
+    "BodyText": null,
+    "ExampleCode": {
+     "Items": [
+      "$ConfigDir = \"/home/myprog/config\";$uname = GetUserInput(\"username\");\n                            \n                            \n                            ExitError(\"Bad hacker!\") if ($uname !~ /^\\w+$/);$file = \"$ConfigDir/$uname.txt\";if (! (-e $file)) {}..."
+     ],
+     "Language": "Perl",
+     "Nature": "Bad"
+    },
+    "References": {
+     "Reference": null
+    },
+    "DemonstrativeExampleID": ""
    },
+   {
+    "TitleText": "",
+    "IntroText": null,
+    "BodyText": null,
+    "ExampleCode": {
+     "Items": [
+      "public BankAccount getUserBankAccount(String username, String accountNumber) {}"
+     ],
+     "Language": "Java",
+     "Nature": "Bad"
+    },
+    "References": {
+     "Reference": null
+    },
+    "DemonstrativeExampleID": "DX-119"
+   }
+  ]
+ },
+ "ObservedExamples": {
+  "ObservedExample": [
+   {
+    "Reference": "CVE-2008-2049",
+    "Description": null,
+    "Link": "https://www.cve.org/CVERecord?id=CVE-2008-2049"
+   },
+   {
+    "Reference": "CVE-2007-5172",
+    "Description": null,
+    "Link": "https://www.cve.org/CVERecord?id=CVE-2007-5172"
+   },
+   {
+    "Reference": "CVE-2008-4638",
+    "Description": null,
+    "Link": "https://www.cve.org/CVERecord?id=CVE-2008-4638"
+   },
+   {
+    "Reference": "CVE-2008-1579",
+    "Description": null,
+    "Link": "https://www.cve.org/CVERecord?id=CVE-2008-1579"
+   },
+   {
+    "Reference": "CVE-2007-1409",
+    "Description": null,
+    "Link": "https://www.cve.org/CVERecord?id=CVE-2007-1409"
+   },
+   {
+    "Reference": "CVE-2008-3060",
+    "Description": null,
+    "Link": "https://www.cve.org/CVERecord?id=CVE-2008-3060"
+   },
+   {
+    "Reference": "CVE-2005-0603",
+    "Description": null,
+    "Link": "https://www.cve.org/CVERecord?id=CVE-2005-0603"
+   },
+   {
+    "Reference": "CVE-2017-9615",
+    "Description": null,
+    "Link": "https://www.cve.org/CVERecord?id=CVE-2017-9615"
+   },
+   {
+    "Reference": "CVE-2018-1999036",
+    "Description": null,
+    "Link": "https://www.cve.org/CVERecord?id=CVE-2018-1999036"
+   }
+  ]
+ },
+ "FunctionalAreas": {
+  "FunctionalArea": null
+ },
+ "AffectedResources": {
+  "AffectedResource": null
+ },
+ "TaxonomyMappings": {
+  "TaxonomyMapping": [
+   {
+    "EntryID": "",
+    "EntryName": "Accidental leaking of sensitive information through error messages",
+    "MappingFit": "",
+    "TaxonomyName": "CLASP"
+   },
+   {
+    "EntryID": "A6",
+    "EntryName": "Information Leakage and Improper Error Handling",
+    "MappingFit": "CWE More Specific",
+    "TaxonomyName": "OWASP Top Ten 2007"
+   },
+   {
+    "EntryID": "A7",
+    "EntryName": "Improper Error Handling",
+    "MappingFit": "CWE More Specific",
+    "TaxonomyName": "OWASP Top Ten 2004"
+   },
+   {
+    "EntryID": "A10",
+    "EntryName": "Insecure Configuration Management",
+    "MappingFit": "CWE More Specific",
+    "TaxonomyName": "OWASP Top Ten 2004"
+   },
+   {
+    "EntryID": "ERR01-J",
+    "EntryName": "Do not allow exceptions to expose sensitive information",
+    "MappingFit": "",
+    "TaxonomyName": "The CERT Oracle Secure Coding Standard for Java (2011)"
+   },
+   {
+    "EntryID": "SFP23",
+    "EntryName": "Exposed Data",
+    "MappingFit": "",
+    "TaxonomyName": "Software Fault Patterns"
+   }
+  ]
+ },
+ "RelatedAttackPatterns": {
+  "RelatedAttackPattern": [
    {
     "CAPECID": 215
    },
@@ -79,21 +412,413 @@
    }
   ]
  },
- "CommonConsequences": {
-  "Consequence": [
+ "References": {
+  "Reference": [
    {
-    "Scope": [
-     "Confidentiality"
+    "ExternalReferenceID": "REF-174",
+    "Section": ""
+   },
+   {
+    "ExternalReferenceID": "REF-175",
+    "Section": "Section 9.2, Page 326"
+   },
+   {
+    "ExternalReferenceID": "REF-176",
+    "Section": "Chapter 16, \"General Good Practices.\" Page 415"
+   },
+   {
+    "ExternalReferenceID": "REF-44",
+    "Section": "\"Sin 11: Failure to Handle Errors Correctly.\" Page 183"
+   },
+   {
+    "ExternalReferenceID": "REF-44",
+    "Section": "\"Sin 12: Information Leakage.\" Page 191"
+   },
+   {
+    "ExternalReferenceID": "REF-179",
+    "Section": ""
+   },
+   {
+    "ExternalReferenceID": "REF-62",
+    "Section": "Chapter 3, \"Overly Verbose Error Messages\", Page 75"
+   },
+   {
+    "ExternalReferenceID": "REF-18",
+    "Section": ""
+   }
+  ]
+ },
+ "MappingNotes": {
+  "Usage": "Allowed",
+  "Rationale": null,
+  "Comments": null,
+  "Reasons": {
+   "Reason": [
+    {
+     "Type": "Acceptable-Use"
+    }
+   ]
+  },
+  "Suggestions": {
+   "Suggestion": null
+  }
+ },
+ "Notes": {
+  "Note": [
+   {
+    "Items": [
+     "The sensitive information may be valuable information on its own (such as a password), or it may be useful for launching other, more serious attacks.",
+     "The error message may be created in different ways:",
+     "\n                        \n                        \n                    "
     ],
-    "Impact": [
-     "Read Application Data"
-    ]
+    "Type": "Other"
    }
   ]
  },
- "ExtendedDescription": [
-  "The sensitive information may be valuable information on its own (such as a password), or it may be useful for launching other, more serious attacks. The error message may be created in different ways:",
-  "\n                    \n                ",
-  "An attacker may use the contents of error messages to help launch another, more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of \"..\" sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query."
- ]
+ "ContentHistory": {
+  "Submission": {
+   "SubmissionName": "CLASP",
+   "SubmissionOrganization": "",
+   "SubmissionDate": "2006-07-19T00:00:00Z",
+   "SubmissionVersion": "Draft 3",
+   "SubmissionReleaseDate": "2006-07-19T00:00:00Z",
+   "SubmissionComment": ""
+  },
+  "Modification": [
+   {
+    "ModificationName": "Eric Dalci",
+    "ModificationOrganization": "Cigital",
+    "ModificationDate": "2008-07-01T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Time_of_Introduction"
+   },
+   {
+    "ModificationName": "",
+    "ModificationOrganization": "Veracode",
+    "ModificationDate": "2008-08-15T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "Suggested OWASP Top Ten 2004 mapping"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2008-09-08T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Applicable_Platforms, Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2008-10-14T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Relationships"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2009-01-12T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Demonstrative_Examples, Description, Name, Observed_Examples, Other_Notes, Potential_Mitigations, Relationships, Time_of_Introduction"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2009-03-10T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Demonstrative_Examples, Potential_Mitigations, Relationships"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2009-12-28T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Demonstrative_Examples, Name, Potential_Mitigations, References, Time_of_Introduction"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2010-02-16T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Detection_Factors, References, Relationships"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2010-04-05T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Related_Attack_Patterns"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2010-06-21T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Common_Consequences, Detection_Factors, Potential_Mitigations, References"
+   },
+   {
+    "ModificationName": "",
+    "ModificationOrganization": "Veracode",
+    "ModificationDate": "2010-09-09T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "Suggested OWASP Top Ten mapping"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2010-09-27T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Potential_Mitigations, Relationships"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2011-03-29T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Demonstrative_Examples, Observed_Examples, Relationships"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2011-06-01T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Relationships, Taxonomy_Mappings"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2011-06-27T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Relationships"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2011-09-13T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Relationships, Taxonomy_Mappings"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2012-05-11T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated References, Related_Attack_Patterns, Relationships"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2013-07-17T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated References"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2014-06-23T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Relationships"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2014-07-30T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Relationships, Taxonomy_Mappings"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2017-11-08T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Applicable_Platforms, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2018-03-27T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated References, Relationships"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2019-01-03T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Taxonomy_Mappings"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2019-06-20T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Relationships"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2019-09-19T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Demonstrative_Examples, Observed_Examples"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2020-02-24T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Applicable_Platforms, Description, Name, Observed_Examples, References, Relationships, Weakness_Ordinalities"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2020-12-10T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Potential_Mitigations, Related_Attack_Patterns"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2021-07-20T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Relationships"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2021-10-28T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Relationships"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2022-10-13T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Demonstrative_Examples"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2023-01-31T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Description"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2023-04-27T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Detection_Factors, References, Relationships"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2023-06-29T00:00:00Z",
+    "ModificationVersion": "",
+    "ModificationReleaseDate": "0001-01-01T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Mapping_Notes"
+   },
+   {
+    "ModificationName": "CWE Content Team",
+    "ModificationOrganization": "MITRE",
+    "ModificationDate": "2025-09-09T00:00:00Z",
+    "ModificationVersion": "4.18",
+    "ModificationReleaseDate": "2025-09-09T00:00:00Z",
+    "ModificationImportance": "",
+    "ModificationComment": "updated Common_Consequences, Description, Diagram, Other_Notes, References"
+   }
+  ],
+  "Contribution": [
+   {
+    "ContributionName": "Nick Johnston",
+    "ContributionOrganization": "",
+    "ContributionDate": "2022-07-11T00:00:00Z",
+    "ContributionVersion": "",
+    "ContributionReleaseDate": "0001-01-01T00:00:00Z",
+    "ContributionComment": "Identified incorrect language tag in demonstrative example.",
+    "Type": "Feedback"
+   }
+  ],
+  "PreviousEntryName": [
+   {
+    "Value": "Error Message Information Leaks",
+    "Date": "2009-01-12T00:00:00Z",
+    "Version": ""
+   },
+   {
+    "Value": "Error Message Information Leak",
+    "Date": "2009-12-28T00:00:00Z",
+    "Version": ""
+   },
+   {
+    "Value": "Information Exposure Through an Error Message",
+    "Date": "2020-02-24T00:00:00Z",
+    "Version": ""
+   }
+  ]
+ }
 }
\ No newline at end of file
diff --git a/cwe/goldens/good-small-cwe.xml b/cwe/goldens/good-small-cwe.xml
index b7f685f..93969c2 100644
--- a/cwe/goldens/good-small-cwe.xml
+++ b/cwe/goldens/good-small-cwe.xml
@@ -1,21 +1,7 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<Weakness_Catalog
-        xmlns="http://cwe.mitre.org/cwe-6"
-        xmlns:xhtml="http://www.w3.org/1999/xhtml"
-        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Name="VIEW LIST: CWE-1026: Weaknesses in OWASP Top Ten (2017)" Version="4.1" Date="2020-06-25" xsi:schemaLocation="http://cwe.mitre.org/cwe-6 http://cwe.mitre.org/data/xsd/cwe_schema_v6.3.xsd">
+<?xml version="1.0" encoding="UTF-8"?><Weakness_Catalog Name="CWE" Version="4.18" Date="2025-09-09" xmlns="http://cwe.mitre.org/cwe-7" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://cwe.mitre.org/cwe-7 http://cwe.mitre.org/data/xsd/cwe_schema_v7.2.xsd" xmlns:xhtml="http://www.w3.org/1999/xhtml">
     <Weaknesses>
-        <Weakness ID="209" Name="Generation of Error Message Containing Sensitive Information" Abstraction="Base" Structure="Simple" Status="Draft">
-            <Description>The software generates an error message that includes sensitive information about its environment, users, or associated data.</Description>
-            <Extended_Description>
-                <xhtml:p>The sensitive information may be valuable information on its own (such as a password), or it may be useful for launching other, more serious attacks. The error message may be created in different ways:</xhtml:p>
-                <xhtml:div style="margin-left:10px;">
-                    <xhtml:ul>
-                        <xhtml:li>self-generated: the source code explicitly constructs the error message and delivers it</xhtml:li>
-                        <xhtml:li>externally-generated: the external environment, such as a language interpreter, handles the error and constructs its own message, whose contents are not under direct control by the programmer</xhtml:li>
-                    </xhtml:ul>
-                </xhtml:div>
-                <xhtml:p>An attacker may use the contents of error messages to help launch another, more focused attack. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.</xhtml:p>
-            </Extended_Description>
+        <Weakness ID="209" Name="Generation of Error Message Containing Sensitive Information" Abstraction="Base" Structure="Simple" Status="Draft" Diagram="/data/images/CWE-209-Diagram.png">
+            <Description>The product generates an error message that includes sensitive information about its environment, users, or associated data.</Description>
             <Related_Weaknesses>
                 <Related_Weakness Nature="ChildOf" CWE_ID="200" View_ID="1000" Ordinal="Primary"/>
                 <Related_Weakness Nature="ChildOf" CWE_ID="200" View_ID="1003" Ordinal="Primary"/>
@@ -32,7 +18,7 @@
             <Applicable_Platforms>
                 <Language Name="PHP" Prevalence="Often"/>
                 <Language Name="Java" Prevalence="Often"/>
-                <Language Class="Language-Independent" Prevalence="Undetermined"/>
+                <Language Class="Not Language-Specific" Prevalence="Undetermined"/>
             </Applicable_Platforms>
             <Modes_Of_Introduction>
                 <Introduction>
@@ -54,7 +40,7 @@
                 <Consequence>
                     <Scope>Confidentiality</Scope>
                     <Impact>Read Application Data</Impact>
-                    <Note>Often this will either reveal sensitive information which may be used for a later attack or private information stored in the server.</Note>
+                    <Note>Often this will either reveal sensitive information which may be used to launch another, more focused attack  or disclose private information stored in the server. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.</Note>
                 </Consequence>
             </Common_Consequences>
             <Detection_Methods>
@@ -80,13 +66,18 @@
                     <Method>Manual Dynamic Analysis</Method>
                     <Description>Identify error conditions that are not likely to occur during normal usage and trigger them. For example, run the program under low memory conditions, run with insufficient privileges or permissions, interrupt a transaction before it is completed, or disable connectivity to basic network services such as DNS. Monitor the software for any unexpected behavior. If you trigger an unhandled exception or similar error that was discovered and handled by the application's environment, it may still indicate unexpected conditions that were not handled by the application itself.</Description>
                 </Detection_Method>
+                <Detection_Method Detection_Method_ID="DM-14">
+                    <Method>Automated Static Analysis</Method>
+                    <Description>Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)</Description>
+                </Detection_Method>
             </Detection_Methods>
             <Potential_Mitigations>
                 <Mitigation Mitigation_ID="MIT-39">
                     <Phase>Implementation</Phase>
                     <Description>
-                        <xhtml:p>Ensure that error messages only contain minimal details that are useful to the intended audience, and nobody else. The messages need to strike the balance between being too cryptic and not being cryptic enough. They should not necessarily reveal the methods that were used to determine the error. Such detailed information can be used to refine the original attack to increase the chances of success.</xhtml:p>
-                        <xhtml:p>If errors must be tracked in some detail, capture them in log messages - but consider what could occur if the log messages can be viewed by attackers. Avoid recording highly sensitive information such as passwords in any form. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a username is valid or not.</xhtml:p>
+                        <xhtml:p>Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success.</xhtml:p>
+                        <xhtml:p>If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files.</xhtml:p>
+                        <xhtml:p>Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.</xhtml:p>
                     </Description>
                 </Mitigation>
                 <Mitigation>
@@ -124,72 +115,36 @@
             <Demonstrative_Examples>
                 <Demonstrative_Example>
                     <Intro_Text>In the following example, sensitive information might be printed depending on the exception that occurs.</Intro_Text>
-                    <Example_Code Nature="bad" Language="Java">
-                        <xhtml:div>try {
-                            <xhtml:div style="margin-left:10px;">/.../</xhtml:div>}
-                            <xhtml:br/>catch (Exception e) {
-                            <xhtml:div style="margin-left:10px;">System.out.println(e);</xhtml:div>}
-                        </xhtml:div>
+                    <Example_Code Nature="Bad" Language="Java">
+                        <xhtml:div>try {<xhtml:div style="margin-left:1em;">/.../</xhtml:div>}<xhtml:br/>catch (Exception e) {<xhtml:div style="margin-left:1em;">System.out.println(e);</xhtml:div>}</xhtml:div>
                     </Example_Code>
                     <Body_Text>If an exception related to SQL is handled by the catch, then the output might contain sensitive information such as SQL query structure or private information. If this output is redirected to a web user, this may represent a security problem.</Body_Text>
                 </Demonstrative_Example>
                 <Demonstrative_Example Demonstrative_Example_ID="DX-118">
                     <Intro_Text>This code tries to open a database connection, and prints any exceptions that occur.</Intro_Text>
-                    <Example_Code Nature="bad" Language="Java">
-                        <xhtml:div>try {
-                            <xhtml:div style="margin-left:10px;">openDbConnection();</xhtml:div>}
-                            <xhtml:br/>
+                    <Example_Code Nature="Bad" Language="PHP">
+                        <xhtml:div>try {<xhtml:div style="margin-left:1em;">openDbConnection();</xhtml:div>}<xhtml:br/>
                             <xhtml:i>//print exception message that includes exception message and configuration file location</xhtml:i>
-                            <xhtml:br/>catch (Exception $e) {
-                            <xhtml:div style="margin-left:10px;">echo 'Caught exception: ', $e-&gt;getMessage(), '\n';
-                                <xhtml:br/>echo 'Check credentials in config file at: ', $Mysql_config_location, '\n';
-                            </xhtml:div>}
-                        </xhtml:div>
+                            <xhtml:br/>catch (Exception $e) {<xhtml:div style="margin-left:1em;">echo 'Caught exception: ', $e-&gt;getMessage(), '\n';<xhtml:br/>echo 'Check credentials in config file at: ', $Mysql_config_location, '\n';</xhtml:div>}</xhtml:div>
                     </Example_Code>
                     <Body_Text>If an exception occurs, the printed message exposes the location of the configuration file the script is using. An attacker can use this information to target the configuration file (perhaps exploiting a Path Traversal weakness). If the file can be read, the attacker could gain credentials for accessing the database. The attacker may also be able to replace the file with a malicious one, causing the application to use an arbitrary database.</Body_Text>
                 </Demonstrative_Example>
                 <Demonstrative_Example>
                     <Intro_Text>The following code generates an error message that leaks the full pathname of the configuration file.</Intro_Text>
-                    <Example_Code Nature="bad" Language="Perl">
-                        <xhtml:div>$ConfigDir = "/home/myprog/config";
-                            <xhtml:br/>$uname = GetUserInput("username");
-                            <xhtml:br/>
+                    <Example_Code Nature="Bad" Language="Perl">
+                        <xhtml:div>$ConfigDir = "/home/myprog/config";<xhtml:br/>$uname = GetUserInput("username");<xhtml:br/>
                             <xhtml:br/>
                             <xhtml:i># avoid CWE-22, CWE-78, others.</xhtml:i>
-                            <xhtml:br/>ExitError("Bad hacker!") if ($uname !~ /^\w+$/);
-                            <xhtml:br/>$file = "$ConfigDir/$uname.txt";
-                            <xhtml:br/>if (! (-e $file)) {
-                            <xhtml:div style="margin-left:10px;">ExitError("Error: $file does not exist");</xhtml:div>}
-                            <xhtml:br/>...
-                        </xhtml:div>
+                            <xhtml:br/>ExitError("Bad hacker!") if ($uname !~ /^\w+$/);<xhtml:br/>$file = "$ConfigDir/$uname.txt";<xhtml:br/>if (! (-e $file)) {<xhtml:div style="margin-left:1em;">ExitError("Error: $file does not exist");</xhtml:div>}<xhtml:br/>...</xhtml:div>
                     </Example_Code>
                     <Body_Text>If this code is running on a server, such as a web application, then the person making the request should not know what the full pathname of the configuration directory is. By submitting a username that does not produce a $file that exists, an attacker could get this pathname. It could then be used to exploit path traversal or symbolic link following problems that may exist elsewhere in the application.</Body_Text>
                 </Demonstrative_Example>
                 <Demonstrative_Example Demonstrative_Example_ID="DX-119">
                     <Intro_Text>In the example below, the method getUserBankAccount retrieves a bank account object from a database using the supplied username and account number to query the database. If an SQLException is raised when querying the database, an error message is created and output to a log file.</Intro_Text>
-                    <Example_Code Nature="bad" Language="Java">
-                        <xhtml:div>public BankAccount getUserBankAccount(String username, String accountNumber) {
-                            <xhtml:div style="margin-left:10px;">
-                                <xhtml:div>BankAccount userAccount = null;
-                                    <xhtml:br/>String query = null;
-                                    <xhtml:br/>try {
-                                    <xhtml:div style="margin-left:10px;">if (isAuthorizedUser(username)) {
-                                        <xhtml:div style="margin-left:10px;">query = "SELECT * FROM accounts WHERE owner = "
-                                            <xhtml:br/>+ username + " AND accountID = " + accountNumber;
-                                            <xhtml:br/>DatabaseManager dbManager = new DatabaseManager();
-                                            <xhtml:br/>Connection conn = dbManager.getConnection();
-                                            <xhtml:br/>Statement stmt = conn.createStatement();
-                                            <xhtml:br/>ResultSet queryResult = stmt.executeQuery(query);
-                                            <xhtml:br/>userAccount = (BankAccount)queryResult.getObject(accountNumber);
-                                        </xhtml:div>}
-                                    </xhtml:div>} catch (SQLException ex) {
-                                    <xhtml:div style="margin-left:10px;">String logMessage = "Unable to retrieve account information from database,\nquery: " + query;
-                                        <xhtml:br/>Logger.getLogger(BankManager.class.getName()).log(Level.SEVERE, logMessage, ex);
-                                    </xhtml:div>}
-                                    <xhtml:br/>return userAccount;
-                                </xhtml:div>
-                            </xhtml:div>}
-                        </xhtml:div>
+                    <Example_Code Nature="Bad" Language="Java">
+                        <xhtml:div>public BankAccount getUserBankAccount(String username, String accountNumber) {<xhtml:div style="margin-left:1em;">
+                            <xhtml:div>BankAccount userAccount = null;<xhtml:br/>String query = null;<xhtml:br/>try {<xhtml:div style="margin-left:1em;">if (isAuthorizedUser(username)) {<xhtml:div style="margin-left:1em;">query = "SELECT * FROM accounts WHERE owner = "<xhtml:br/>+ username + " AND accountID = " + accountNumber;<xhtml:br/>DatabaseManager dbManager = new DatabaseManager();<xhtml:br/>Connection conn = dbManager.getConnection();<xhtml:br/>Statement stmt = conn.createStatement();<xhtml:br/>ResultSet queryResult = stmt.executeQuery(query);<xhtml:br/>userAccount = (BankAccount)queryResult.getObject(accountNumber);</xhtml:div>}</xhtml:div>} catch (SQLException ex) {<xhtml:div style="margin-left:1em;">String logMessage = "Unable to retrieve account information from database,\nquery: " + query;<xhtml:br/>Logger.getLogger(BankManager.class.getName()).log(Level.SEVERE, logMessage, ex);</xhtml:div>}<xhtml:br/>return userAccount;</xhtml:div>
+                        </xhtml:div>}</xhtml:div>
                     </Example_Code>
                     <Body_Text>The error message that is created includes information about the database query that may contain sensitive information about the database or query logic. In this case, the error message will expose the table name and column names used in the database. This data could be used to simplify other attacks, such as SQL injection (CWE-89) to directly access the database.</Body_Text>
                 </Demonstrative_Example>
@@ -198,47 +153,47 @@
                 <Observed_Example>
                     <Reference>CVE-2008-2049</Reference>
                     <Description>POP3 server reveals a password in an error message after multiple APOP commands are sent. Might be resultant from another weakness.</Description>
-                    <Link>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2049</Link>
+                    <Link>https://www.cve.org/CVERecord?id=CVE-2008-2049</Link>
                 </Observed_Example>
                 <Observed_Example>
                     <Reference>CVE-2007-5172</Reference>
                     <Description>Program reveals password in error message if attacker can trigger certain database errors.</Description>
-                    <Link>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5172</Link>
+                    <Link>https://www.cve.org/CVERecord?id=CVE-2007-5172</Link>
                 </Observed_Example>
                 <Observed_Example>
                     <Reference>CVE-2008-4638</Reference>
                     <Description>Composite: application running with high privileges (CWE-250) allows user to specify a restricted file to process, which generates a parsing error that leaks the contents of the file (CWE-209).</Description>
-                    <Link>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4638</Link>
+                    <Link>https://www.cve.org/CVERecord?id=CVE-2008-4638</Link>
                 </Observed_Example>
                 <Observed_Example>
                     <Reference>CVE-2008-1579</Reference>
                     <Description>Existence of user names can be determined by requesting a nonexistent blog and reading the error message.</Description>
-                    <Link>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1579</Link>
+                    <Link>https://www.cve.org/CVERecord?id=CVE-2008-1579</Link>
                 </Observed_Example>
                 <Observed_Example>
                     <Reference>CVE-2007-1409</Reference>
                     <Description>Direct request to library file in web application triggers pathname leak in error message.</Description>
-                    <Link>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1409</Link>
+                    <Link>https://www.cve.org/CVERecord?id=CVE-2007-1409</Link>
                 </Observed_Example>
                 <Observed_Example>
                     <Reference>CVE-2008-3060</Reference>
                     <Description>Malformed input to login page causes leak of full path when IMAP call fails.</Description>
-                    <Link>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3060</Link>
+                    <Link>https://www.cve.org/CVERecord?id=CVE-2008-3060</Link>
                 </Observed_Example>
                 <Observed_Example>
                     <Reference>CVE-2005-0603</Reference>
                     <Description>Malformed regexp syntax leads to information exposure in error message.</Description>
-                    <Link>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0603</Link>
+                    <Link>https://www.cve.org/CVERecord?id=CVE-2005-0603</Link>
                 </Observed_Example>
                 <Observed_Example>
                     <Reference>CVE-2017-9615</Reference>
                     <Description>verbose logging stores admin credentials in a world-readablelog file</Description>
-                    <Link>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9615</Link>
+                    <Link>https://www.cve.org/CVERecord?id=CVE-2017-9615</Link>
                 </Observed_Example>
                 <Observed_Example>
                     <Reference>CVE-2018-1999036</Reference>
                     <Description>SSH password for private key stored in build log</Description>
-                    <Link>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1999036</Link>
+                    <Link>https://www.cve.org/CVERecord?id=CVE-2018-1999036</Link>
                 </Observed_Example>
             </Observed_Examples>
             <Taxonomy_Mappings>
@@ -270,7 +225,6 @@
                 </Taxonomy_Mapping>
             </Taxonomy_Mappings>
             <Related_Attack_Patterns>
-                <Related_Attack_Pattern CAPEC_ID="214"/>
                 <Related_Attack_Pattern CAPEC_ID="215"/>
                 <Related_Attack_Pattern CAPEC_ID="463"/>
                 <Related_Attack_Pattern CAPEC_ID="54"/>
@@ -286,10 +240,30 @@
                 <Reference External_Reference_ID="REF-62" Section="Chapter 3, &#34;Overly Verbose Error Messages&#34;, Page 75"/>
                 <Reference External_Reference_ID="REF-18"/>
             </References>
+            <Mapping_Notes>
+                <Usage>Allowed</Usage>
+                <Rationale>This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.</Rationale>
+                <Comments>Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.</Comments>
+                <Reasons>
+                    <Reason Type="Acceptable-Use"/>
+                </Reasons>
+            </Mapping_Notes>
+            <Notes>
+                <Note Type="Other">
+                    <xhtml:p>The sensitive information may be valuable information on its own (such as a password), or it may be useful for launching other, more serious attacks.</xhtml:p>
+                    <xhtml:p>The error message may be created in different ways:</xhtml:p>
+                    <xhtml:ul>
+                        <xhtml:li>self-generated: the source code explicitly constructs the error message and delivers it</xhtml:li>
+                        <xhtml:li>externally-generated: the external environment, such as a language interpreter, handles the error and constructs its own message, whose contents are not under direct control by the programmer</xhtml:li>
+                    </xhtml:ul>
+                </Note>
+            </Notes>
             <Content_History>
                 <Submission>
                     <Submission_Name>CLASP</Submission_Name>
                     <Submission_Date>2006-07-19</Submission_Date>
+                    <Submission_Version>Draft 3</Submission_Version>
+                    <Submission_ReleaseDate>2006-07-19</Submission_ReleaseDate>
                 </Submission>
                 <Modification>
                     <Modification_Name>Eric Dalci</Modification_Name>
@@ -445,6 +419,61 @@
                     <Modification_Date>2020-02-24</Modification_Date>
                     <Modification_Comment>updated Applicable_Platforms, Description, Name, Observed_Examples, References, Relationships, Weakness_Ordinalities</Modification_Comment>
                 </Modification>
+                <Modification>
+                    <Modification_Name>CWE Content Team</Modification_Name>
+                    <Modification_Organization>MITRE</Modification_Organization>
+                    <Modification_Date>2020-12-10</Modification_Date>
+                    <Modification_Comment>updated Potential_Mitigations, Related_Attack_Patterns</Modification_Comment>
+                </Modification>
+                <Modification>
+                    <Modification_Name>CWE Content Team</Modification_Name>
+                    <Modification_Organization>MITRE</Modification_Organization>
+                    <Modification_Date>2021-07-20</Modification_Date>
+                    <Modification_Comment>updated Relationships</Modification_Comment>
+                </Modification>
+                <Modification>
+                    <Modification_Name>CWE Content Team</Modification_Name>
+                    <Modification_Organization>MITRE</Modification_Organization>
+                    <Modification_Date>2021-10-28</Modification_Date>
+                    <Modification_Comment>updated Relationships</Modification_Comment>
+                </Modification>
+                <Modification>
+                    <Modification_Name>CWE Content Team</Modification_Name>
+                    <Modification_Organization>MITRE</Modification_Organization>
+                    <Modification_Date>2022-10-13</Modification_Date>
+                    <Modification_Comment>updated Demonstrative_Examples</Modification_Comment>
+                </Modification>
+                <Modification>
+                    <Modification_Name>CWE Content Team</Modification_Name>
+                    <Modification_Organization>MITRE</Modification_Organization>
+                    <Modification_Date>2023-01-31</Modification_Date>
+                    <Modification_Comment>updated Description</Modification_Comment>
+                </Modification>
+                <Modification>
+                    <Modification_Name>CWE Content Team</Modification_Name>
+                    <Modification_Organization>MITRE</Modification_Organization>
+                    <Modification_Date>2023-04-27</Modification_Date>
+                    <Modification_Comment>updated Detection_Factors, References, Relationships</Modification_Comment>
+                </Modification>
+                <Modification>
+                    <Modification_Name>CWE Content Team</Modification_Name>
+                    <Modification_Organization>MITRE</Modification_Organization>
+                    <Modification_Date>2023-06-29</Modification_Date>
+                    <Modification_Comment>updated Mapping_Notes</Modification_Comment>
+                </Modification>
+                <Modification>
+                    <Modification_Name>CWE Content Team</Modification_Name>
+                    <Modification_Organization>MITRE</Modification_Organization>
+                    <Modification_Date>2025-09-09</Modification_Date>
+                    <Modification_Version>4.18</Modification_Version>
+                    <Modification_ReleaseDate>2025-09-09</Modification_ReleaseDate>
+                    <Modification_Comment>updated Common_Consequences, Description, Diagram, Other_Notes, References</Modification_Comment>
+                </Modification>
+                <Contribution Type="Feedback">
+                    <Contribution_Name>Nick Johnston</Contribution_Name>
+                    <Contribution_Date>2022-07-11</Contribution_Date>
+                    <Contribution_Comment>Identified incorrect language tag in demonstrative example.</Contribution_Comment>
+                </Contribution>
                 <Previous_Entry_Name Date="2009-01-12">Error Message Information Leaks</Previous_Entry_Name>
                 <Previous_Entry_Name Date="2009-12-28">Error Message Information Leak</Previous_Entry_Name>
                 <Previous_Entry_Name Date="2020-02-24">Information Exposure Through an Error Message</Previous_Entry_Name>
diff --git a/cwe/goldens/good-small-cwe.xml.zip b/cwe/goldens/good-small-cwe.xml.zip
index f6f6a43..51f1848 100644
Binary files a/cwe/goldens/good-small-cwe.xml.zip and b/cwe/goldens/good-small-cwe.xml.zip differ
diff --git a/debian/tracker/debian.go b/debian/tracker/debian.go
index 89bdc31..25a378c 100644
--- a/debian/tracker/debian.go
+++ b/debian/tracker/debian.go
@@ -23,7 +23,7 @@ const (
 	trackerDir         = "tracker"
 	securityTrackerURL = "https://salsa.debian.org/security-tracker-team/security-tracker/-/archive/master/security-tracker-master.tar.gz//security-tracker-master"
 	sourcesURL         = "https://ftp.debian.org/debian/dists/%s/%s/source/Sources.gz"
-	securitySourcesURL = "https://security.debian.org/debian-security/dists/%s/updates/%s/source/Sources.gz"
+	securitySourcesURL = "https://security.debian.org/debian-security/dists/%s-security/updates/%s/source/Sources.xz"
 )
 
 var (
diff --git a/main.go b/main.go
index 9ba45ac..bed9a09 100644
--- a/main.go
+++ b/main.go
@@ -28,13 +28,14 @@ import (
 	"github.com/aquasecurity/vuln-list-update/nvd"
 	"github.com/aquasecurity/vuln-list-update/openeuler"
 	oracleoval "github.com/aquasecurity/vuln-list-update/oracle/oval"
-	"github.com/aquasecurity/vuln-list-update/osv"
+	"github.com/aquasecurity/vuln-list-update/osvdev"
 	"github.com/aquasecurity/vuln-list-update/photon"
 	redhatcsafvex "github.com/aquasecurity/vuln-list-update/redhat/csaf"
 	redhatoval "github.com/aquasecurity/vuln-list-update/redhat/oval"
 	"github.com/aquasecurity/vuln-list-update/redhat/securitydataapi"
 	"github.com/aquasecurity/vuln-list-update/rocky"
 	"github.com/aquasecurity/vuln-list-update/rootio"
+	"github.com/aquasecurity/vuln-list-update/seal"
 	susecvrf "github.com/aquasecurity/vuln-list-update/suse/cvrf"
 	"github.com/aquasecurity/vuln-list-update/ubuntu"
 	"github.com/aquasecurity/vuln-list-update/utils"
@@ -43,7 +44,7 @@ import (
 
 var (
 	target = flag.String("target", "", "update target (nvd, alpine, alpine-unfixed, redhat, redhat-oval, "+
-		"redhat-csaf-vex, debian, ubuntu, amazon, oracle-oval, suse-cvrf, photon, arch-linux, ghsa, glad, cwe, osv, mariner, kevc, wolfi, "+
+		"redhat-csaf-vex, debian, ubuntu, amazon, oracle-oval, suse-cvrf, photon, arch-linux, ghsa, glad, cwe, osvdev, mariner, kevc, wolfi, "+
 		"chainguard, azure, openeuler, echo, minimos, eoldates, rootio)")
 	vulnListDir  = flag.String("vuln-list-dir", "", "vuln-list dir")
 	targetUri    = flag.String("target-uri", "", "alternative repository URI (only glad)")
@@ -157,8 +158,8 @@ func run() error {
 		if err := rc.Update(); err != nil {
 			return xerrors.Errorf("Rocky Linux update error: %w", err)
 		}
-	case "osv":
-		p := osv.NewOsv()
+	case "osvdev":
+		p := osvdev.NewDatabase()
 		if err := p.Update(); err != nil {
 			return xerrors.Errorf("OSV update error: %w", err)
 		}
@@ -207,6 +208,11 @@ func run() error {
 		if err := ru.Update(); err != nil {
 			return xerrors.Errorf("Root.io update error: %w", err)
 		}
+	case "seal":
+		su := seal.NewSeal()
+		if err := su.Update(); err != nil {
+			return xerrors.Errorf("Seal Security update error: %w", err)
+		}
 	default:
 		return xerrors.New("unknown target")
 	}
diff --git a/osv/osv.go b/osv/osv.go
index e97cc3e..aa5fff2 100644
--- a/osv/osv.go
+++ b/osv/osv.go
@@ -1,3 +1,13 @@
+// Package osv provides generic OSV (Open Source Vulnerability) format specification
+// and reusable vulnerability data processing functionality.
+//
+// This package contains:
+// - OSV format type definitions based on https://ossf.github.io/osv-schema
+// - Generic data processing logic that can work with any OSV-compliant data source
+// - Ecosystem configuration for flexible data source management
+//
+// This is intended as a reusable library that other packages can use to implement
+// specific OSV data sources (e.g., osv.dev, seal).
 package osv
 
 import (
@@ -14,86 +24,52 @@ import (
 	"github.com/aquasecurity/vuln-list-update/utils"
 )
 
-const (
-	securityTrackerURL = "https://osv-vulnerabilities.storage.googleapis.com/%s/all.zip"
-	osvDir             = "osv"
-)
-
-var defaultEcosystemDirs = map[string]string{
-	"PyPI":      "python",
-	"Go":        "go",
-	"crates.io": "rust",
-}
-
-type options struct {
-	url           string
-	dir           string
-	ecosystemDirs map[string]string
-}
-
-type option func(*options)
-
+// Database represents a generic OSV vulnerability database that can process
+// vulnerability data from any OSV-compliant source.
 type Database struct {
-	*options
-}
-
-func WithURL(url string) option {
-	return func(opts *options) {
-		opts.url = url
-	}
-}
-
-func WithDir(dir string) option {
-	return func(opts *options) {
-		opts.dir = dir
-	}
-}
-
-func WithEcosystem(ecosystemDir map[string]string) option {
-	return func(opts *options) {
-		opts.ecosystemDirs = ecosystemDir
-	}
+	baseDir    string               // Base directory for storing vulnerability data
+	ecosystems map[string]Ecosystem // Map of ecosystem name to configuration
 }
 
-func NewOsv(opts ...option) Database {
-	o := &options{
-		url:           securityTrackerURL,
-		dir:           filepath.Join(utils.VulnListDir(), osvDir),
-		ecosystemDirs: defaultEcosystemDirs,
-	}
-	for _, opt := range opts {
-		opt(o)
-	}
+// NewDatabase creates a new generic OSV database instance.
+// baseDir is the root directory where vulnerability data will be stored.
+// ecosystems maps ecosystem names to their configuration (storage directory and source URL).
+func NewDatabase(baseDir string, ecosystems map[string]Ecosystem) Database {
 	return Database{
-		options: o,
+		baseDir:    baseDir,
+		ecosystems: ecosystems,
 	}
 }
 
-func (osv *Database) Update() error {
+func (db *Database) Update() error {
 	ctx := context.Background()
-	for ecoSystem, ecoSystemDir := range osv.ecosystemDirs {
-		log.Printf("Updating OSV %s advisories", ecoSystem)
-		tempDir, err := utils.DownloadToTempDir(ctx, fmt.Sprintf(osv.url, ecoSystem))
+	for name, ecosystem := range db.ecosystems {
+		log.Printf("Updating OSV %s advisories", name)
+
+		tempDir, err := utils.DownloadToTempDir(ctx, ecosystem.URL)
 		if err != nil {
-			return xerrors.Errorf("failed to download %s: %w", fmt.Sprintf(osv.url, ecoSystem), err)
+			return xerrors.Errorf("failed to download %s: %w", ecosystem.URL, err)
 		}
 
-		err = filepath.WalkDir(tempDir, func(path string, d fs.DirEntry, err error) error {
-			if !d.IsDir() {
-				f, err := os.Open(path)
-				if err != nil {
-					return xerrors.Errorf("file open error (%s): %w", path, err)
-				}
+		err = filepath.WalkDir(tempDir, func(path string, d fs.DirEntry, walkErr error) error {
+			if walkErr != nil {
+				return walkErr
+			} else if d.IsDir() {
+				return nil
+			}
+			f, err := os.Open(path)
+			if err != nil {
+				return xerrors.Errorf("file open error (%s): %w", path, err)
+			}
 
-				var parsed OSV
-				if err = json.NewDecoder(f).Decode(&parsed); err != nil {
-					return xerrors.Errorf("unable to parse json %s: %w", path, err)
-				}
+			var parsed OSV
+			if err = json.NewDecoder(f).Decode(&parsed); err != nil {
+				return xerrors.Errorf("unable to parse json %s: %w", path, err)
+			}
 
-				filePath := filepath.Join(osv.dir, ecoSystemDir, parsed.Affected[0].Package.Name, fmt.Sprintf("%s.json", parsed.ID))
-				if err = utils.Write(filePath, parsed); err != nil {
-					return xerrors.Errorf("failed to write file: %w", err)
-				}
+			filePath := filepath.Join(db.baseDir, ecosystem.Dir, parsed.Affected[0].Package.Name, fmt.Sprintf("%s.json", parsed.ID))
+			if err = utils.Write(filePath, parsed); err != nil {
+				return xerrors.Errorf("failed to write file: %w", err)
 			}
 			return nil
 		})
diff --git a/osv/types.go b/osv/types.go
index 95a2f31..6d51f9e 100644
--- a/osv/types.go
+++ b/osv/types.go
@@ -1,12 +1,17 @@
 package osv
 
+type Ecosystem struct {
+	Dir string
+	URL string
+}
+
 type Affected struct {
-	Package    Package     `json:"package,omitempty"`
-	Severities []Severity  `json:"severity,omitempty"`
-	Ranges     []Range     `json:"ranges,omitempty"`
-	Versions   []string    `json:"versions,omitempty"`
-	Ecosystem  interface{} `json:"ecosystem_specific,omitempty"` //The meaning of the values within the object is entirely defined by the ecosystem
-	Database   interface{} `json:"database_specific,omitempty"`  //The meaning of the values within the object is entirely defined by the database
+	Package    Package    `json:"package,omitempty"`
+	Severities []Severity `json:"severity,omitempty"`
+	Ranges     []Range    `json:"ranges,omitempty"`
+	Versions   []string   `json:"versions,omitempty"`
+	Ecosystem  any        `json:"ecosystem_specific,omitempty"` //The meaning of the values within the object is entirely defined by the ecosystem
+	Database   any        `json:"database_specific,omitempty"`  //The meaning of the values within the object is entirely defined by the database
 
 }
 
diff --git a/osvdev/osvdev.go b/osvdev/osvdev.go
new file mode 100644
index 0000000..a32a5ae
--- /dev/null
+++ b/osvdev/osvdev.go
@@ -0,0 +1,71 @@
+// Package osvdev provides OSV vulnerability data collection from osv.dev
+// (osv-vulnerabilities.storage.googleapis.com).
+//
+// This package implements a specific data source for OSV.dev's vulnerability database,
+// which aggregates vulnerability data from multiple ecosystems including:
+// - PyPI (Python packages)
+// - Go (Go modules)
+// - crates.io (Rust crates)
+//
+// It uses the generic osv package to handle OSV format processing and provides
+// OSV.dev-specific configuration such as default URLs and directory structure.
+//
+// This is the recommended replacement for the legacy "osv" target in main.go.
+package osvdev
+
+import (
+	"path/filepath"
+
+	"github.com/aquasecurity/vuln-list-update/osv"
+	"github.com/aquasecurity/vuln-list-update/utils"
+)
+
+const (
+	osvdevDir = "osv"
+)
+
+var defaultEcosystems = map[string]osv.Ecosystem{
+	"PyPI": {
+		Dir: "python",
+		URL: "https://osv-vulnerabilities.storage.googleapis.com/PyPI/all.zip",
+	},
+	"Go": {
+		Dir: "go",
+		URL: "https://osv-vulnerabilities.storage.googleapis.com/Go/all.zip",
+	},
+	"crates.io": {
+		Dir: "rust",
+		URL: "https://osv-vulnerabilities.storage.googleapis.com/crates.io/all.zip",
+	},
+}
+
+type options struct {
+	dir        string
+	ecosystems map[string]osv.Ecosystem
+}
+
+type Option func(*options)
+
+func WithDir(dir string) Option {
+	return func(opts *options) {
+		opts.dir = dir
+	}
+}
+
+func WithEcosystems(ecosystems map[string]osv.Ecosystem) Option {
+	return func(opts *options) {
+		opts.ecosystems = ecosystems
+	}
+}
+
+func NewDatabase(opts ...Option) osv.Database {
+	o := &options{
+		dir:        filepath.Join(utils.VulnListDir(), osvdevDir),
+		ecosystems: defaultEcosystems,
+	}
+	for _, opt := range opts {
+		opt(o)
+	}
+
+	return osv.NewDatabase(o.dir, o.ecosystems)
+}
diff --git a/seal/seal.go b/seal/seal.go
new file mode 100644
index 0000000..6196d44
--- /dev/null
+++ b/seal/seal.go
@@ -0,0 +1,51 @@
+package seal
+
+import (
+	"github.com/aquasecurity/vuln-list-update/osv"
+	"github.com/aquasecurity/vuln-list-update/utils"
+)
+
+const (
+	securityTrackerURL = "http://vulnfeed.sealsecurity.io/v1/osv/renamed/vulnerabilities.zip"
+	sealDir            = "seal"
+)
+
+// Seal uses single archive for all ecosystems, so we use a single ecosystem and single dir.
+var ecosystems = map[string]osv.Ecosystem{
+	"seal": {
+		Dir: sealDir,
+		URL: securityTrackerURL,
+	},
+}
+
+type options struct {
+	dir        string
+	ecosystems map[string]osv.Ecosystem
+}
+
+type Option func(*options)
+
+func WithDir(dir string) Option {
+	return func(opts *options) {
+		opts.dir = dir
+	}
+}
+
+func WithEcosystems(ecosystems map[string]osv.Ecosystem) Option {
+	return func(opts *options) {
+		opts.ecosystems = ecosystems
+	}
+}
+
+func NewSeal(opts ...Option) osv.Database {
+	o := &options{
+		dir:        utils.VulnListDir(),
+		ecosystems: ecosystems,
+	}
+
+	for _, opt := range opts {
+		opt(o)
+	}
+
+	return osv.NewDatabase(o.dir, o.ecosystems)
+}



Test patch:
diff --git a/osv/osv_test.go b/osvdev/osvdev_test.go
similarity index 80%
rename from osv/osv_test.go
rename to osvdev/osvdev_test.go
index ed43eec..e3f7159 100644
--- a/osv/osv_test.go
+++ b/osvdev/osvdev_test.go
@@ -1,4 +1,4 @@
-package osv_test
+package osvdev_test
 
 import (
 	"fmt"
@@ -12,6 +12,7 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"github.com/aquasecurity/vuln-list-update/osv"
+	"github.com/aquasecurity/vuln-list-update/osvdev"
 )
 
 func Test_Update(t *testing.T) {
@@ -65,9 +66,9 @@ func Test_Update(t *testing.T) {
 		},
 		{
 			name: "sad path, unable to download archive",
-			path: "/%s/unknown.zip",
+			path: "/unknown.zip",
 			ecosystem: map[string]string{
-				"PyPI": "python",
+				"unknown": "unknown",
 			},
 			wantErr: "bad response code: 404",
 		},
@@ -77,11 +78,13 @@ func Test_Update(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			mux := http.NewServeMux()
 			for name, dir := range tt.ecosystem {
-				b, err := os.ReadFile(filepath.Join("testdata", dir, "all.zip"))
-				require.NoError(t, err)
 				mux.HandleFunc(fmt.Sprintf("/%s/all.zip", name), func(w http.ResponseWriter, r *http.Request) {
-					_, err = w.Write(b)
-					require.NoError(t, err)
+					if name == "unknown" {
+						http.NotFound(w, r)
+						return
+					}
+					filePath := filepath.Join("testdata", dir, "all.zip")
+					http.ServeFile(w, r, filePath)
 				})
 			}
 			ts := httptest.NewServer(mux)
@@ -90,13 +93,17 @@ func Test_Update(t *testing.T) {
 
 			// build test settings
 			testDir := t.TempDir()
-			testURL := ts.URL + "/%s/all.zip"
-			if tt.path != "" {
-				testURL = ts.URL + tt.path
-				fmt.Println(testURL)
+
+			// Convert old-style ecosystem map to new Ecosystem struct with test URLs
+			ecosystems := make(map[string]osv.Ecosystem)
+			for name, dir := range tt.ecosystem {
+				ecosystems[name] = osv.Ecosystem{
+					Dir: dir,
+					URL: ts.URL + fmt.Sprintf("/%s/all.zip", name),
+				}
 			}
 
-			c := osv.NewOsv(osv.WithURL(testURL), osv.WithDir(testDir), osv.WithEcosystem(tt.ecosystem))
+			c := osvdev.NewDatabase(osvdev.WithDir(testDir), osvdev.WithEcosystems(ecosystems))
 
 			err := c.Update()
 			if tt.wantErr != "" {
diff --git a/osv/testdata/go/all.zip b/osvdev/testdata/go/all.zip
similarity index 100%
rename from osv/testdata/go/all.zip
rename to osvdev/testdata/go/all.zip
diff --git a/osv/testdata/golden/go/github.com/gin-gonic/gin/GO-2020-0001.json b/osvdev/testdata/golden/go/github.com/gin-gonic/gin/GO-2020-0001.json
similarity index 100%
rename from osv/testdata/golden/go/github.com/gin-gonic/gin/GO-2020-0001.json
rename to osvdev/testdata/golden/go/github.com/gin-gonic/gin/GO-2020-0001.json
diff --git a/osv/testdata/golden/go/github.com/seccomp/libseccomp-golang/GO-2020-0007.json b/osvdev/testdata/golden/go/github.com/seccomp/libseccomp-golang/GO-2020-0007.json
similarity index 100%
rename from osv/testdata/golden/go/github.com/seccomp/libseccomp-golang/GO-2020-0007.json
rename to osvdev/testdata/golden/go/github.com/seccomp/libseccomp-golang/GO-2020-0007.json
diff --git a/osv/testdata/golden/go/github.com/tidwall/gjson/GO-2021-0059.json b/osvdev/testdata/golden/go/github.com/tidwall/gjson/GO-2021-0059.json
similarity index 100%
rename from osv/testdata/golden/go/github.com/tidwall/gjson/GO-2021-0059.json
rename to osvdev/testdata/golden/go/github.com/tidwall/gjson/GO-2021-0059.json
diff --git a/osv/testdata/golden/python/aiohttp/PYSEC-2023-120.json b/osvdev/testdata/golden/python/aiohttp/PYSEC-2023-120.json
similarity index 100%
rename from osv/testdata/golden/python/aiohttp/PYSEC-2023-120.json
rename to osvdev/testdata/golden/python/aiohttp/PYSEC-2023-120.json
diff --git a/osv/testdata/golden/python/cherrypy/PYSEC-2006-1.json b/osvdev/testdata/golden/python/cherrypy/PYSEC-2006-1.json
similarity index 100%
rename from osv/testdata/golden/python/cherrypy/PYSEC-2006-1.json
rename to osvdev/testdata/golden/python/cherrypy/PYSEC-2006-1.json
diff --git a/osv/testdata/golden/python/trac/PYSEC-2005-1.json b/osvdev/testdata/golden/python/trac/PYSEC-2005-1.json
similarity index 100%
rename from osv/testdata/golden/python/trac/PYSEC-2005-1.json
rename to osvdev/testdata/golden/python/trac/PYSEC-2005-1.json
diff --git a/osv/testdata/golden/python/trac/PYSEC-2006-2.json b/osvdev/testdata/golden/python/trac/PYSEC-2006-2.json
similarity index 100%
rename from osv/testdata/golden/python/trac/PYSEC-2006-2.json
rename to osvdev/testdata/golden/python/trac/PYSEC-2006-2.json
diff --git a/osv/testdata/golden/rust/openssl/RUSTSEC-2016-0001.json b/osvdev/testdata/golden/rust/openssl/RUSTSEC-2016-0001.json
similarity index 100%
rename from osv/testdata/golden/rust/openssl/RUSTSEC-2016-0001.json
rename to osvdev/testdata/golden/rust/openssl/RUSTSEC-2016-0001.json
diff --git a/osv/testdata/golden/rust/smallvec/RUSTSEC-2019-0009.json b/osvdev/testdata/golden/rust/smallvec/RUSTSEC-2019-0009.json
similarity index 100%
rename from osv/testdata/golden/rust/smallvec/RUSTSEC-2019-0009.json
rename to osvdev/testdata/golden/rust/smallvec/RUSTSEC-2019-0009.json
diff --git a/osv/testdata/golden/rust/tar/RUSTSEC-2018-0002.json b/osvdev/testdata/golden/rust/tar/RUSTSEC-2018-0002.json
similarity index 100%
rename from osv/testdata/golden/rust/tar/RUSTSEC-2018-0002.json
rename to osvdev/testdata/golden/rust/tar/RUSTSEC-2018-0002.json
diff --git a/osv/testdata/python/all.zip b/osvdev/testdata/python/all.zip
similarity index 100%
rename from osv/testdata/python/all.zip
rename to osvdev/testdata/python/all.zip
diff --git a/osv/testdata/rust/all.zip b/osvdev/testdata/rust/all.zip
similarity index 100%
rename from osv/testdata/rust/all.zip
rename to osvdev/testdata/rust/all.zip
diff --git a/seal/seal_test.go b/seal/seal_test.go
new file mode 100644
index 0000000..45a49a9
--- /dev/null
+++ b/seal/seal_test.go
@@ -0,0 +1,85 @@
+package seal_test
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/aquasecurity/vuln-list-update/osv"
+	"github.com/aquasecurity/vuln-list-update/seal"
+)
+
+func Test_Update(t *testing.T) {
+	tests := []struct {
+		name      string
+		path      string
+		wantFiles []string
+		wantErr   string
+	}{
+		{
+			name: "happy path",
+			wantFiles: []string{
+				filepath.Join("seal-screen", "CVE-2025-46803.json"),
+				filepath.Join("seal-glibc", "CVE-2023-6780.json"),
+				filepath.Join("seal-rsync", "CVE-2020-14387.json"),
+			},
+		},
+		{
+			name:    "sad path, unable to download archive",
+			path:    "/unknown.zip",
+			wantErr: "bad response code: 404",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.Path != "/v1/osv/renamed/vulnerabilities.zip" {
+					http.NotFound(w, r)
+					return
+				}
+				http.ServeFile(w, r, filepath.Join("testdata", "vulnerabilities.zip"))
+			}))
+			defer ts.Close()
+
+			// build test settings
+			testDir := t.TempDir()
+			testURL := ts.URL + "/v1/osv/renamed/vulnerabilities.zip"
+			if tt.path != "" {
+				testURL = ts.URL + tt.path
+			}
+
+			// Create ecosystems map with test URL
+			ecosystems := map[string]osv.Ecosystem{
+				"seal": {
+					Dir: "",
+					URL: testURL,
+				},
+			}
+
+			c := seal.NewSeal(seal.WithDir(testDir), seal.WithEcosystems(ecosystems))
+
+			err := c.Update()
+			if tt.wantErr != "" {
+				require.ErrorContains(t, err, tt.wantErr)
+				return
+			}
+			assert.NoError(t, err)
+
+			for _, wantFile := range tt.wantFiles {
+				got, err := os.ReadFile(filepath.Join(testDir, wantFile))
+				require.NoError(t, err)
+
+				want, err := os.ReadFile(filepath.Join("testdata", "golden", wantFile))
+				require.NoError(t, err)
+
+				assert.JSONEq(t, string(want), string(got))
+			}
+		})
+	}
+}
diff --git a/seal/testdata/golden/seal-glibc/CVE-2023-6780.json b/seal/testdata/golden/seal-glibc/CVE-2023-6780.json
new file mode 100644
index 0000000..52a04e7
--- /dev/null
+++ b/seal/testdata/golden/seal-glibc/CVE-2023-6780.json
@@ -0,0 +1,26 @@
+{
+  "id": "CVE-2023-6780",
+  "modified": "2024-12-10T13:50:49.173936Z",
+  "published": "2024-01-31T00:00:00Z",
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Seal:Debian",
+        "name": "seal-glibc"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.36-9+deb12u3"
+            },
+            {
+              "fixed": "2.36-9+deb12u3+sp999"
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/seal/testdata/golden/seal-rsync/CVE-2020-14387.json b/seal/testdata/golden/seal-rsync/CVE-2020-14387.json
new file mode 100644
index 0000000..d96ba5c
--- /dev/null
+++ b/seal/testdata/golden/seal-rsync/CVE-2020-14387.json
@@ -0,0 +1,26 @@
+{
+  "id": "CVE-2020-14387",
+  "modified": "2025-02-10T10:38:07.628922Z",
+  "published": "2021-05-27T00:00:00Z",
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Seal:Alpine",
+        "name": "seal-rsync"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.3.0-r0"
+            },
+            {
+              "fixed": "3.3.0-r05341999"
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/seal/testdata/golden/seal-screen/CVE-2025-46803.json b/seal/testdata/golden/seal-screen/CVE-2025-46803.json
new file mode 100644
index 0000000..f22de04
--- /dev/null
+++ b/seal/testdata/golden/seal-screen/CVE-2025-46803.json
@@ -0,0 +1,45 @@
+{
+  "id": "CVE-2025-46803",
+  "modified": "2025-05-14T12:02:46.351557Z",
+  "published": "2025-05-13T00:00:00Z",
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Seal:Red Hat:6",
+        "name": "seal-screen"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.0.3-19.el6"
+            },
+            {
+              "fixed": "4.0.3-19.el6+sp999"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Seal:Red Hat:7",
+        "name": "seal-screen"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "4.1.0-0.27.20120314git3c2946.el7_9"
+            },
+            {
+              "fixed": "4.1.0-0.27.20120314git3c2946.el7_9+sp999"
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file
diff --git a/seal/testdata/vulnerabilities.zip b/seal/testdata/vulnerabilities.zip
new file mode 100644
index 0000000..f6cfb72
Binary files /dev/null and b/seal/testdata/vulnerabilities.zip differ