"They"? MITRE runs cve.org under contract by CISA.