The standard for indexing, categorizing, and determining the severity of the exploit is CVE. The CVE was launched in 1999 as a community effort to standardize the reporting of exploits, and the MITRE Corporation now runs it. The organization has copyrighted the CVE list and trademarked its name in an ongoing effort to keep the standard free and open-sourced.