Since you did not delivered some examples, such as: where did you get information that a CVE does not deliver CPE - either by the basis of some platform or files provided by some specific vendor. I assume you are using the National Vulnerability Database (NVD) Data Feeds, either in XML 2.0 or JSON format provided by NIST at https://nvd.nist.gov/vuln/data-feeds
, because the information collected from NIST's (NVDCVE) files is the same in CVEDetails.com
.
You claim that there are over a thousand entries without CPE:
$ ls -lh
total 96136
-rw-r--r-- 1 test test 44M Aug 18 03:25 nvdcve-2.0-2016.xml
-rw-r--r-- 1 test test 2.6M Aug 20 06:57 nvdcve-2.0-2016.xml.zip
$ grep -c "\*\* REJECT \*\*" nvdcve-2.0-2016.xml
1106
If you are wondering, why did I used the keyword "REJECT": This is the only way that there is a CVE and cannot find a CPE. For example:
$ grep -A5 "<entry id=\"CVE-2016-0001\">" nvdcve-2.0-2016.xml
<entry id="CVE-2016-0001">
<vuln:cve-id>CVE-2016-0001</vuln:cve-id>
<vuln:published-datetime>2017-05-11T10:29:55.767-04:00</vuln:published-datetime>
<vuln:last-modified-datetime>2017-05-11T10:29:55.767-04:00</vuln:last-modified-datetime>
<vuln:summary>** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none.</vuln:summary>
</entry>
The reason why this happens, I have explained in this question: Categorizing CVE product name