Is there a CVE-like thing for malware? It seems as though CVEs/MITRE are just security hole reports, and the viruses that use these holes are left as an exercis

Is there a CVE-like thing for malware? It seems as though CVEs/MITRE are just security hole reports, and the viruses that use these holes are left as an exercise of one's imagination.