diff --git a/guix/cve.scm b/guix/cve.scm
index 7dd9005f09..52a19e0523 100644
--- a/guix/cve.scm
+++ b/guix/cve.scm
@@ -1,5 +1,5 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2015, 2016, 2017, 2018, 2019 Ludovic Courtès <ludo@gnu.org>
+;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020 Ludovic Courtès <ludo@gnu.org>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -54,6 +54,7 @@
             vulnerability?
             vulnerability-id
             vulnerability-packages
+            vulnerability-references
 
             json->vulnerabilities
             current-vulnerabilities
@@ -255,20 +256,23 @@ records."
   (* 3600 24 (date-month %now)))
 
 (define-record-type <vulnerability>
-  (vulnerability id packages)
+  (vulnerability id packages references)
   vulnerability?
   (id         vulnerability-id)             ;string
-  (packages   vulnerability-packages))      ;((p1 sexp1) (p2 sexp2) ...)
+  (packages   vulnerability-packages)       ;((p1 sexp1) (p2 sexp2) ...)
+  (references vulnerability-references))    ;list of URLs
 
 (define vulnerability->sexp
   (match-lambda
-    (($ <vulnerability> id packages)
-     `(v ,id ,packages))))
+    (($ <vulnerability> id packages references)
+     `(v ,id ,packages ,references))))
 
 (define sexp->vulnerability
   (match-lambda
-    (('v id (packages ...))
-     (vulnerability id packages))))
+    (('v id (packages ...) (references ...))      ;format version 2
+     (vulnerability id packages references))
+    (('v id (packages ...))                       ;format version 1
+     (vulnerability id packages '()))))
 
 (define (cve-configuration->package-list config)
   "Parse CONFIG, a config sexp, and return a list of the form (P SEXP)
@@ -313,20 +317,23 @@ versions."
   "Return a <vulnerability> corresponding to ITEM, a <cve-item> record;
 return #f if ITEM does not list any configuration or if it does not list
 any \"a\" (application) configuration."
-  (let ((id (cve-id (cve-item-cve item))))
+  (let ((id         (cve-id (cve-item-cve item)))
+        (references (cve-references (cve-item-cve item))))
     (match (cve-item-configurations item)
       (()                                         ;no configurations
        #f)
       ((configs ...)
        (vulnerability id
                       (merge-package-lists
-                       (map cve-configuration->package-list configs)))))))
+                       (map cve-configuration->package-list configs))
+                      (filter-map cve-reference-url references))))))
 
 (define (json->vulnerabilities json)
   "Parse JSON, an input port or a string, and return the list of
 vulnerabilities found therein."
   (filter-map cve-item->vulnerability (json->cve-items json)))
 
+(use-modules (ice-9 pretty-print))
 (define (write-cache input cache)
   "Read vulnerabilities as gzipped JSON from INPUT, and write it as a compact
 sexp to CACHE."
@@ -335,8 +342,8 @@ sexp to CACHE."
       (define vulns
         (json->vulnerabilities input))
 
-      (write `(vulnerabilities
-               1                                  ;format version
+      (pretty-print `(vulnerabilities
+               2                                  ;format version
                ,(map vulnerability->sexp vulns))
              cache))))
 
@@ -369,7 +376,7 @@ the given TTL (fetch from the NIST web site when TTL has expired)."
          (sexp (read* port)))
     (close-port port)
     (match sexp
-      (('vulnerabilities 1 vulns)
+      (('vulnerabilities (or 2 1) vulns)
        (map sexp->vulnerability vulns)))))
 
 (define (current-vulnerabilities)
diff --git a/guix/lint.scm b/guix/lint.scm
index 445c06f8f4..6b65df34a3 100644
--- a/guix/lint.scm
+++ b/guix/lint.scm
@@ -1108,6 +1108,23 @@ vulnerability records for PACKAGE by calling PACKAGE-VULNERABILITIES."
                (list (string-join (map vulnerability-id unpatched)
                                   ", "))))))))))
 
+(define* (check-cpe-name package
+                         #:optional (vulnerabilities
+                                     (current-vulnerabilities*)))
+  (define home-page
+    (package-home-page package))
+
+  (filter-map (lambda (vuln)
+                (and (any (cut string-prefix? home-page <>)
+                          (vulnerability-references vuln))
+                     (make-warning
+                      package
+                      (G_ "suggested CPE name: '~a'")
+                      (match (vulnerability-packages vuln)
+                        (((p _) _ ...)
+                         (list p))))))
+              vulnerabilities))
+
 (define (check-for-updates package)
   "Check if there is an update available for PACKAGE."
   (match (with-networking-fail-safe
@@ -1426,6 +1443,10 @@ or a list thereof")
      (description "Check the Common Vulnerabilities and Exposures\
  (CVE) database")
      (check       check-vulnerabilities))
+   (lint-checker
+     (name        'cpe)
+     (description "Check the Common Platform Enumeration names")
+     (check       check-cpe-name))
    (lint-checker
      (name        'refresh)
      (description "Check the package for new upstream releases")
