There is a minor typo in your README: > Adding support for PURL identifiers using the packageURL propertiy with the affected array items propertiy -> property PS: I am the maintainer of the Package-URL spec. See also related: - https://github.com/CVEProject/cvelistV5/pull/115 - https://github.com/CVEProject/cvelistV5/pull/117