major mailing lists and vulnerability databases, with the likely
exception of data from 2003.
OS VENDOR: this data set identifies CVEs that are associated with
operating system (OS) vendor advisories, which would capture