diff --git a/mingw-w64-3proxy/PKGBUILD b/mingw-w64-3proxy/PKGBUILD
index 8d62087aa9..2d81dd1cbc 100644
--- a/mingw-w64-3proxy/PKGBUILD
+++ b/mingw-w64-3proxy/PKGBUILD
@@ -11,6 +11,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 license=('BSD' 'Apache' 'GPL' 'LGPL')
 url="https://github.com/z3APA3A/${_realname}"
+msys2_references=(
+  "cpe: cpe:/a:3proxy:3proxy"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc")
 source=(${_realname}-${pkgver}.tar.gz::"${url}/archive/${pkgver}.tar.gz"
diff --git a/mingw-w64-7zip/PKGBUILD b/mingw-w64-7zip/PKGBUILD
index 0e701e7df9..b7011f385a 100644
--- a/mingw-w64-7zip/PKGBUILD
+++ b/mingw-w64-7zip/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'aur: 7-zip'
+  "cpe: cpe:/a:7-zip:7-zip"
 )
 url="https://7-zip.org"
 license=('spdx:LGPL-2.1-or-later AND BSD-3-Clause')
diff --git a/mingw-w64-SDL/PKGBUILD b/mingw-w64-SDL/PKGBUILD
index d66c300a43..eef5f768f5 100644
--- a/mingw-w64-SDL/PKGBUILD
+++ b/mingw-w64-SDL/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="A library for portable low-level access to a video framebuffer, audio o
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://libsdl.org"
+msys2_references=(
+  "cpe: cpe:/a:libsdl:libsdl"
+  "cpe: cpe:/a:libsdl:simple_directmedia_layer"
+)
 license=("LGPL")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools" 'git')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs" "${MINGW_PACKAGE_PREFIX}-libiconv")
diff --git a/mingw-w64-SDL2/PKGBUILD b/mingw-w64-SDL2/PKGBUILD
index 07a03f80c5..595a3c988e 100644
--- a/mingw-w64-SDL2/PKGBUILD
+++ b/mingw-w64-SDL2/PKGBUILD
@@ -11,6 +11,8 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: sdl2'
+  "cpe: cpe:/a:libsdl:libsdl"
+  "cpe: cpe:/a:libsdl:simple_directmedia_layer"
 )
 msys2_repository_url="https://github.com/libsdl-org/SDL/"
 url="https://libsdl.org/"
diff --git a/mingw-w64-SDL2_image/PKGBUILD b/mingw-w64-SDL2_image/PKGBUILD
index 215771e5ca..eee9dc3657 100644
--- a/mingw-w64-SDL2_image/PKGBUILD
+++ b/mingw-w64-SDL2_image/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A simple library to load images of various formats as SDL surfaces (Ver
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/libsdl-org/SDL_image"
+msys2_references=(
+  "cpe: cpe:/a:libsdl:sdl2_image"
+)
 license=('spdx:Zlib')
 depends=("${MINGW_PACKAGE_PREFIX}-SDL2"
          "${MINGW_PACKAGE_PREFIX}-libavif"
diff --git a/mingw-w64-SDL2_ttf/PKGBUILD b/mingw-w64-SDL2_ttf/PKGBUILD
index b7c18e8772..c171b74d36 100644
--- a/mingw-w64-SDL2_ttf/PKGBUILD
+++ b/mingw-w64-SDL2_ttf/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="A library that allows you to use TrueType fonts in your SDL application
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/libsdl-org/SDL_ttf"
+msys2_references=(
+  "cpe: cpe:/a:libsdl:sdl_ttf"
+)
 license=('spdx:Zlib')
 depends=("${MINGW_PACKAGE_PREFIX}-SDL2"
          "${MINGW_PACKAGE_PREFIX}-freetype"
diff --git a/mingw-w64-SDL_image/PKGBUILD b/mingw-w64-SDL_image/PKGBUILD
index 5895b67c7d..fc22a0bc9d 100644
--- a/mingw-w64-SDL_image/PKGBUILD
+++ b/mingw-w64-SDL_image/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="A simple library to load images of various formats as SDL surfaces (min
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://libsdl.org/projects/SDL_image"
+msys2_references=(
+  "cpe: cpe:/a:libsdl:sdl_image"
+  "cpe: cpe:/a:sdl:sdl_image"
+)
 license=('MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-SDL"
          "${MINGW_PACKAGE_PREFIX}-libjpeg-turbo"
diff --git a/mingw-w64-SDL_ttf/PKGBUILD b/mingw-w64-SDL_ttf/PKGBUILD
index 3cba919af8..dd1ad730b6 100644
--- a/mingw-w64-SDL_ttf/PKGBUILD
+++ b/mingw-w64-SDL_ttf/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A library that allows you to use TrueType fonts in your SDL application
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32')
 url="https://libsdl.org/projects/SDL_ttf/"
+msys2_references=(
+  "cpe: cpe:/a:libsdl:sdl_ttf"
+)
 license=("custom")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-autotools")
diff --git a/mingw-w64-advancecomp/PKGBUILD b/mingw-w64-advancecomp/PKGBUILD
index 4c117e75cb..709d9419d8 100644
--- a/mingw-w64-advancecomp/PKGBUILD
+++ b/mingw-w64-advancecomp/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='Recompression utilities for .zip .png .mng and .gz files using the 7-zi
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url='http://www.advancemame.it/comp-readme'
+msys2_references=(
+  "cpe: cpe:/a:advancemame:advancecomp"
+)
 license=('spdx:GPL-3.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-zlib")
diff --git a/mingw-w64-antiword/PKGBUILD b/mingw-w64-antiword/PKGBUILD
index fa9762d2cb..f9fb220d15 100644
--- a/mingw-w64-antiword/PKGBUILD
+++ b/mingw-w64-antiword/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('GPL3+')
 url="http://www.winfield.demon.nl/"
+msys2_references=(
+  "cpe: cpe:/a:antiword_project:antiword"
+)
 options=('strip')
 source=("http://www.winfield.demon.nl/linux/${_realname}-${pkgver}.tar.gz"
         "0001-Make-antiword.exe-relocatable-on-Windows.patch")
diff --git a/mingw-w64-apr-util/PKGBUILD b/mingw-w64-apr-util/PKGBUILD
index c69323fdfb..3703811015 100644
--- a/mingw-w64-apr-util/PKGBUILD
+++ b/mingw-w64-apr-util/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="The Apache Portable Runtime (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://apr.apache.org/"
+msys2_references=(
+  "cpe: cpe:/a:apache:apr-util"
+)
 license=('spdx:Apache-2.0')
 depends=("${MINGW_PACKAGE_PREFIX}-apr"
          "${MINGW_PACKAGE_PREFIX}-expat"
diff --git a/mingw-w64-apr/PKGBUILD b/mingw-w64-apr/PKGBUILD
index 2928880543..01ae4ea010 100644
--- a/mingw-w64-apr/PKGBUILD
+++ b/mingw-w64-apr/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="The Apache Portable Runtime (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://apr.apache.org/"
+msys2_references=(
+  "cpe: cpe:/a:apache:portable_runtime"
+)
 license=('spdx:Apache-2.0')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-aria2/PKGBUILD b/mingw-w64-aria2/PKGBUILD
index f0e33f7b53..86f46ac3e6 100644
--- a/mingw-w64-aria2/PKGBUILD
+++ b/mingw-w64-aria2/PKGBUILD
@@ -12,6 +12,8 @@ url='https://aria2.github.io/'
 msys2_repository_url='https://github.com/aria2/aria2/'
 msys2_references=(
   'archlinux: aria2'
+  "cpe: cpe:/a:aria2_project:aria2"
+  "cpe: cpe:/a:tatsuhiro_tsujikawa:aria2"
 )
 license=('spdx:GPL-2.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-arm-none-eabi-binutils/PKGBUILD b/mingw-w64-arm-none-eabi-binutils/PKGBUILD
index 21157920c8..215621d00f 100644
--- a/mingw-w64-arm-none-eabi-binutils/PKGBUILD
+++ b/mingw-w64-arm-none-eabi-binutils/PKGBUILD
@@ -14,6 +14,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 license=('spdx:GPL-3.0-or-later AND GPL-2.0-or-later AND LGPL-3.0-or-later AND LGPL-2.0-or-later')
 url='https://www.gnu.org/software/binutils/binutils.html'
+msys2_references=(
+  "cpe: cpe:/a:gnu:binutils"
+)
 groups=("${MINGW_PACKAGE_PREFIX}-${_target}-toolchain")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-libwinpthread-git"
diff --git a/mingw-w64-arm-none-eabi-gcc/PKGBUILD b/mingw-w64-arm-none-eabi-gcc/PKGBUILD
index f66e2373b4..2f620e95ee 100644
--- a/mingw-w64-arm-none-eabi-gcc/PKGBUILD
+++ b/mingw-w64-arm-none-eabi-gcc/PKGBUILD
@@ -16,6 +16,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64')
 license=('GPL')
 url='https://www.gnu.org/software/gcc/gcc.html'
+msys2_references=(
+  "cpe: cpe:/a:gnu:gcc"
+)
 groups=("${MINGW_PACKAGE_PREFIX}-${_target}-toolchain")
 provides=($([[ "$_enable_ada" == "yes" ]] && echo "${MINGW_PACKAGE_PREFIX}-${_target}-gcc-ada"))
 depends=(
diff --git a/mingw-w64-arrow/PKGBUILD b/mingw-w64-arrow/PKGBUILD
index b15fe79283..ec1ef286ca 100644
--- a/mingw-w64-arrow/PKGBUILD
+++ b/mingw-w64-arrow/PKGBUILD
@@ -12,6 +12,7 @@ url="https://arrow.apache.org/"
 msys2_repository_url="https://github.com/apache/arrow"
 msys2_references=(
   'archlinux: arrow'
+  "cpe: cpe:/a:apache:arrow"
 )
 license=('spdx:Apache-2.0')
 depends=("${MINGW_PACKAGE_PREFIX}-abseil-cpp"
diff --git a/mingw-w64-aspell/PKGBUILD b/mingw-w64-aspell/PKGBUILD
index c246329863..b7f3ec2756 100644
--- a/mingw-w64-aspell/PKGBUILD
+++ b/mingw-w64-aspell/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A spell checker designed to eventually replace Ispell (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="http://aspell.net/"
+msys2_references=(
+  "cpe: cpe:/a:gnu:aspell"
+)
 license=("LGPL")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-assimp/PKGBUILD b/mingw-w64-assimp/PKGBUILD
index ea4d88928f..19d4e751cc 100644
--- a/mingw-w64-assimp/PKGBUILD
+++ b/mingw-w64-assimp/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Portable Open Source library to import various well-known 3D model form
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.assimp.org/"
+msys2_references=(
+  "cpe: cpe:/a:assimp:assimp"
+)
 license=('BSD')
 depends=("${MINGW_PACKAGE_PREFIX}-minizip"
          "${MINGW_PACKAGE_PREFIX}-zlib")
diff --git a/mingw-w64-aubio/PKGBUILD b/mingw-w64-aubio/PKGBUILD
index 04623adb0e..fdaa45c2fc 100644
--- a/mingw-w64-aubio/PKGBUILD
+++ b/mingw-w64-aubio/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='A tool for extracting annotations from audio signals (mingw-w64)'
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://aubio.org/'
+msys2_references=(
+  "cpe: cpe:/a:aubio:aubio"
+)
 license=('spdx:GPL-3.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-ffmpeg"
          "${MINGW_PACKAGE_PREFIX}-fftw"
diff --git a/mingw-w64-avr-binutils/PKGBUILD b/mingw-w64-avr-binutils/PKGBUILD
index 225923a73e..ac04916950 100644
--- a/mingw-w64-avr-binutils/PKGBUILD
+++ b/mingw-w64-avr-binutils/PKGBUILD
@@ -12,6 +12,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 license=('spdx:GPL-3.0-or-later AND GPL-2.0-or-later AND LGPL-3.0-or-later AND LGPL-2.0-or-later')
 url='https://www.gnu.org/software/binutils/binutils.html'
+msys2_references=(
+  "cpe: cpe:/a:gnu:binutils"
+)
 groups=("${MINGW_PACKAGE_PREFIX}-${_target}-toolchain")
 depends=("${MINGW_PACKAGE_PREFIX}-zstd")
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools" "${MINGW_PACKAGE_PREFIX}-cc")
diff --git a/mingw-w64-avr-gcc/PKGBUILD b/mingw-w64-avr-gcc/PKGBUILD
index 62a9d74d3d..1bb48c3e2e 100644
--- a/mingw-w64-avr-gcc/PKGBUILD
+++ b/mingw-w64-avr-gcc/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc='GNU compiler collection for AVR 8-bit and 32-bit microcontrollers (ming
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64')
 url='https://www.gnu.org/software/gcc/gcc.html'
+msys2_references=(
+  "cpe: cpe:/a:gnu:gcc"
+)
 license=('spdx:GPL-3.0-or-later')
 groups=("${MINGW_PACKAGE_PREFIX}-${_target}-toolchain")
 depends=("${MINGW_PACKAGE_PREFIX}-${_target}-binutils"
diff --git a/mingw-w64-bat/PKGBUILD b/mingw-w64-bat/PKGBUILD
index 74ff9b78b0..d7238c9541 100644
--- a/mingw-w64-bat/PKGBUILD
+++ b/mingw-w64-bat/PKGBUILD
@@ -12,6 +12,7 @@ url='https://github.com/sharkdp/bat'
 msys2_references=(
   'archlinux: bat'
   'purl: pkg:cargo/bat'
+  "cpe: cpe:/a:bat_project:bat"
 )
 license=('spdx:MIT OR Apache-2.0')
 depends=(
diff --git a/mingw-w64-binaryen/PKGBUILD b/mingw-w64-binaryen/PKGBUILD
index b36512e115..ac65ba15b4 100644
--- a/mingw-w64-binaryen/PKGBUILD
+++ b/mingw-w64-binaryen/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Compiler infrastructure and toolchain library for WebAssembly, in C++ (
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://github.com/WebAssembly/binaryen"
+msys2_references=(
+  "cpe: cpe:/a:webassembly:binaryen"
+)
 license=('Apache')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-binutils/PKGBUILD b/mingw-w64-binutils/PKGBUILD
index 3d8e2cbed7..829f6af932 100644
--- a/mingw-w64-binutils/PKGBUILD
+++ b/mingw-w64-binutils/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="A set of programs to assemble and manipulate binary and object files (m
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64')
 url="https://www.gnu.org/software/binutils/"
+msys2_references=(
+  "cpe: cpe:/a:gnu:binutils"
+)
 license=('spdx:GPL-3.0-or-later AND GPL-2.0-or-later AND LGPL-3.0-or-later AND LGPL-2.0-or-later')
 groups=("${MINGW_PACKAGE_PREFIX}-toolchain")
 depends=("${MINGW_PACKAGE_PREFIX}-zstd" "${MINGW_PACKAGE_PREFIX}-zlib" "${MINGW_PACKAGE_PREFIX}-gettext-runtime")
diff --git a/mingw-w64-boost/PKGBUILD b/mingw-w64-boost/PKGBUILD
index dd9571950f..a6bdd0bd61 100644
--- a/mingw-w64-boost/PKGBUILD
+++ b/mingw-w64-boost/PKGBUILD
@@ -16,6 +16,7 @@ url="https://www.boost.org/"
 msys2_repository_url="https://github.com/boostorg/boost"
 msys2_references=(
   'archlinux: boost'
+  "cpe: cpe:/a:boost:boost"
 )
 license=('spdx:BSL-1.0')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-brotli/PKGBUILD b/mingw-w64-brotli/PKGBUILD
index b40dc1a0ad..0599411d24 100644
--- a/mingw-w64-brotli/PKGBUILD
+++ b/mingw-w64-brotli/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="Brotli compression library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://github.com/google/brotli'
+msys2_references=(
+  "cpe: cpe:/a:google:brotli"
+)
 makedepends=("${MINGW_PACKAGE_PREFIX}-cmake"
              "${MINGW_PACKAGE_PREFIX}-ninja"
              "${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-bzip2/PKGBUILD b/mingw-w64-bzip2/PKGBUILD
index bb6c14befc..095a01db71 100644
--- a/mingw-w64-bzip2/PKGBUILD
+++ b/mingw-w64-bzip2/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="A high-quality data compression program (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://sourceware.org/bzip2/"
+msys2_references=(
+  "cpe: cpe:/a:bzip:bzip2"
+)
 license=("custom")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
diff --git a/mingw-w64-c-ares/PKGBUILD b/mingw-w64-c-ares/PKGBUILD
index 424dc38abd..5533004fcb 100644
--- a/mingw-w64-c-ares/PKGBUILD
+++ b/mingw-w64-c-ares/PKGBUILD
@@ -11,6 +11,8 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: c-ares'
+  "cpe: cpe:/a:c-ares_project:c-ares"
+  "cpe: cpe:/a:daniel_stenberg:c-ares"
 )
 msys2_repository_url='https://github.com/c-ares/c-ares/'
 msys2_changelog_url='https://c-ares.org/changelog.html'
diff --git a/mingw-w64-capnproto/PKGBUILD b/mingw-w64-capnproto/PKGBUILD
index de1a803bd7..5d680ed8e1 100644
--- a/mingw-w64-capnproto/PKGBUILD
+++ b/mingw-w64-capnproto/PKGBUILD
@@ -15,6 +15,9 @@ pkgdesc="Cap'n Proto serialization/RPC system (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://capnproto.org/'
+msys2_references=(
+  "cpe: cpe:/a:capnproto:capnproto"
+)
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-openssl"
diff --git a/mingw-w64-cfitsio/PKGBUILD b/mingw-w64-cfitsio/PKGBUILD
index cb50ecfcae..d3ae8b8bf5 100644
--- a/mingw-w64-cfitsio/PKGBUILD
+++ b/mingw-w64-cfitsio/PKGBUILD
@@ -11,6 +11,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://heasarc.gsfc.nasa.gov/fitsio/"
 msys2_repository_url='https://github.com/HEASARC/cfitsio'
+msys2_references=(
+  "cpe: cpe:/a:nasa:cfitsio"
+)
 license=("spdx:NASA-1.3")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cmake"
              "${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-cgal/PKGBUILD b/mingw-w64-cgal/PKGBUILD
index 8bdf1761b1..45fd5ce05f 100644
--- a/mingw-w64-cgal/PKGBUILD
+++ b/mingw-w64-cgal/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.cgal.org/"
 msys2_repository_url="https://github.com/CGAL/cgal"
+msys2_references=(
+  "cpe: cpe:/a:cgal:computational_geometry_algorithms_library"
+)
 license=("spdx:CC0-1.0 AND BSL-1.0 AND MIT AND LGPL-3.0-or-later AND GPL-3.0-or-later")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-chafa/PKGBUILD b/mingw-w64-chafa/PKGBUILD
index 7acd92f0d0..b25563c28a 100644
--- a/mingw-w64-chafa/PKGBUILD
+++ b/mingw-w64-chafa/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_repository_url='https://github.com/hpjansson/chafa'
 url='https://hpjansson.org/chafa/'
+msys2_references=(
+  "cpe: cpe:/a:chafa_project:chafa"
+)
 license=('spdx:LGPL-3.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-cairo"
          "${MINGW_PACKAGE_PREFIX}-freetype"
diff --git a/mingw-w64-chicken/PKGBUILD b/mingw-w64-chicken/PKGBUILD
index fe168d7df7..8e7b33e74d 100644
--- a/mingw-w64-chicken/PKGBUILD
+++ b/mingw-w64-chicken/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='Feature rich R5RS Scheme compiler and interpreter (mingw-w64)'
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url='https://call-cc.org/'
+msys2_references=(
+  "cpe: cpe:/a:call-cc:chicken"
+)
 license=('BSD')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc")
 source=("https://code.call-cc.org/releases/$pkgver/${_realname}-$pkgver.tar.gz")
diff --git a/mingw-w64-civetweb/PKGBUILD b/mingw-w64-civetweb/PKGBUILD
index fdadded8f9..def066a709 100644
--- a/mingw-w64-civetweb/PKGBUILD
+++ b/mingw-w64-civetweb/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Embedded C/C++ web server (mingw-w64)"
 arch=(any)
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://github.com/civetweb/civetweb"
+msys2_references=(
+  "cpe: cpe:/a:civetweb_project:civetweb"
+)
 license=("spdx:MIT")
 depends=("${MINGW_PACKAGE_PREFIX}-openssl"
          "${MINGW_PACKAGE_PREFIX}-libwinpthread-git")
diff --git a/mingw-w64-cjson/PKGBUILD b/mingw-w64-cjson/PKGBUILD
index d95c3391c0..7bbfc962a9 100644
--- a/mingw-w64-cjson/PKGBUILD
+++ b/mingw-w64-cjson/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Ultralightweight JSON parser in ANSI C (mingw-w64)"
 arch=(any)
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://github.com/DaveGamble/cJSON"
+msys2_references=(
+  "cpe: cpe:/a:cjson_project:cjson"
+)
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-confuse/PKGBUILD b/mingw-w64-confuse/PKGBUILD
index 66ad0bde2e..374c4f59e6 100644
--- a/mingw-w64-confuse/PKGBUILD
+++ b/mingw-w64-confuse/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='Library for parsing configuration files (mingw-w64)'
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://github.com/martinh/libconfuse"
+msys2_references=(
+  "cpe: cpe:/a:libconfuse_project:libconfuse"
+)
 license=('custom')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools" "${MINGW_PACKAGE_PREFIX}-gettext-tools")
 depends=("${MINGW_PACKAGE_PREFIX}-gettext-runtime")
diff --git a/mingw-w64-crypto++/PKGBUILD b/mingw-w64-crypto++/PKGBUILD
index 5c0b16e910..291801e56c 100644
--- a/mingw-w64-crypto++/PKGBUILD
+++ b/mingw-w64-crypto++/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Crypto++ Library is a free C++ class library of cryptographic schemes (
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.cryptopp.com/"
+msys2_references=(
+  "cpe: cpe:/a:cryptopp:crypto%2b%2b"
+)
 license=('spdx:BSL-1.0')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-curl/PKGBUILD b/mingw-w64-curl/PKGBUILD
index 53bfc3fc72..dc7e1a9bb6 100644
--- a/mingw-w64-curl/PKGBUILD
+++ b/mingw-w64-curl/PKGBUILD
@@ -14,7 +14,11 @@ url="https://curl.se/"
 msys2_repository_url="https://github.com/curl/curl"
 msys2_changelog_url="https://curl.se/changes.html"
 msys2_references=(
+  "cpe: cpe:/a:curl:curl"
+  "cpe: cpe:/a:curl:libcurl"
   "cpe: cpe:/a:haxx:curl"
+  "cpe: cpe:/a:haxx:libcurl"
+  "cpe: cpe:/a:libcurl:libcurl"
 )
 license=("spdx:MIT")
 _cert_depends=("${MINGW_PACKAGE_PREFIX}-ca-certificates"
diff --git a/mingw-w64-cyrus-sasl/PKGBUILD b/mingw-w64-cyrus-sasl/PKGBUILD
index 782ecd5aea..5b52c570a0 100644
--- a/mingw-w64-cyrus-sasl/PKGBUILD
+++ b/mingw-w64-cyrus-sasl/PKGBUILD
@@ -30,6 +30,11 @@ pkgdesc="Cyrus Simple Authentication Service Layer (SASL) library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.cyrusimap.org/sasl/"
+msys2_references=(
+  "cpe: cpe:/a:carnegie_mellon_university:cyrus-sasl"
+  "cpe: cpe:/a:cyrus:sasl"
+  "cpe: cpe:/a:cyrusimap:cyrus-sasl"
+)
 license=('custom')
 depends=("${MINGW_PACKAGE_PREFIX}-gdbm"
          "${MINGW_PACKAGE_PREFIX}-openssl"
diff --git a/mingw-w64-dav1d/PKGBUILD b/mingw-w64-dav1d/PKGBUILD
index b9dc06d951..e5bb311223 100644
--- a/mingw-w64-dav1d/PKGBUILD
+++ b/mingw-w64-dav1d/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="AV1 cross-platform decoder focused on speed and correctness (mingw-w64)
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://code.videolan.org/videolan/dav1d'
+msys2_references=(
+  "cpe: cpe:/a:videolan:dav1d"
+)
 license=('spdx:BSD-2-Clause')
 makedepends=("${MINGW_PACKAGE_PREFIX}-pkgconf"
              $( [[ "${CARCH}" != "i686" \
diff --git a/mingw-w64-db/PKGBUILD b/mingw-w64-db/PKGBUILD
index 81893ec96a..eeae2cbe62 100644
--- a/mingw-w64-db/PKGBUILD
+++ b/mingw-w64-db/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="The Berkeley DB embedded database system (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.oracle.com/technetwork/database/database-technologies/berkeleydb/overview/index.html"
+msys2_references=(
+  "cpe: cpe:/a:oracle:berkeley_db"
+)
 license=('custom')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-libwinpthread-git")
diff --git a/mingw-w64-dbus-glib/PKGBUILD b/mingw-w64-dbus-glib/PKGBUILD
index 10616395ec..4b536225e6 100644
--- a/mingw-w64-dbus-glib/PKGBUILD
+++ b/mingw-w64-dbus-glib/PKGBUILD
@@ -13,6 +13,9 @@ makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools" "$
 options=('strip' 'staticlibs')
 license=("BSD")
 url="https://www.freedesktop.org/wiki/Software/dbus"
+msys2_references=(
+  "cpe: cpe:/a:freedesktop:dbus-glib"
+)
 source=("https://dbus.freedesktop.org/releases/${_realname}/${_realname}-${pkgver}.tar.gz"{,.asc})
 sha256sums=('7d550dccdfcd286e33895501829ed971eeb65c614e73aadb4a08aeef719b143a'
             'SKIP')
diff --git a/mingw-w64-dbus/PKGBUILD b/mingw-w64-dbus/PKGBUILD
index d5d8da1c5b..2b40cc483e 100644
--- a/mingw-w64-dbus/PKGBUILD
+++ b/mingw-w64-dbus/PKGBUILD
@@ -18,6 +18,10 @@ makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "xmlto")
 license=('spdx:AFL-2.1 OR GPL-2.0-or-later')
 url="https://www.freedesktop.org/wiki/Software/dbus"
+msys2_references=(
+  "cpe: cpe:/a:d-bus_project:d-bus"
+  "cpe: cpe:/a:freedesktop:dbus"
+)
 source=("https://dbus.freedesktop.org/releases/dbus/${_realname}-${pkgver}.tar.xz"{,.asc})
 sha256sums=('ba1f21d2bd9d339da2d4aa8780c09df32fea87998b73da24f49ab9df1e36a50f'
             'SKIP')
diff --git a/mingw-w64-dcmtk/PKGBUILD b/mingw-w64-dcmtk/PKGBUILD
index 87f456de06..519ab4dd93 100644
--- a/mingw-w64-dcmtk/PKGBUILD
+++ b/mingw-w64-dcmtk/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='http://dicom.offis.de/dcmtk'
 msys2_repository_url="https://git.dcmtk.org/?p=dcmtk.git"
+msys2_references=(
+  "cpe: cpe:/a:offis:dcmtk"
+)
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-icu"
          "${MINGW_PACKAGE_PREFIX}-libiconv"
diff --git a/mingw-w64-dcraw/PKGBUILD b/mingw-w64-dcraw/PKGBUILD
index 9ba443c0bd..87fd1f97ef 100644
--- a/mingw-w64-dcraw/PKGBUILD
+++ b/mingw-w64-dcraw/PKGBUILD
@@ -10,6 +10,10 @@ pkgdesc="Decoder for any raw image from any digital camera"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://www.dechifro.org/dcraw/"
+msys2_references=(
+  "cpe: cpe:/a:dave_coffin:dcraw"
+  "cpe: cpe:/a:dcraw_project:dcraw"
+)
 license=("GPLv2")
 options=('strip')
 depends=("${MINGW_PACKAGE_PREFIX}-lcms2"
diff --git a/mingw-w64-dia/PKGBUILD b/mingw-w64-dia/PKGBUILD
index f876eb66cf..2e8ba60e67 100644
--- a/mingw-w64-dia/PKGBUILD
+++ b/mingw-w64-dia/PKGBUILD
@@ -10,7 +10,8 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://gitlab.gnome.org/GNOME/dia'
 msys2_references=(
-  'cpe: cpe:/a:dia:dia'
+  "cpe: cpe:/a:dia:dia"
+  "cpe: cpe:/a:gnome:dia"
 )
 license=('spdx:GPL-2.0-or-later')
 depends=(
diff --git a/mingw-w64-djvulibre/PKGBUILD b/mingw-w64-djvulibre/PKGBUILD
index 36e14af1ac..fd676ccc84 100644
--- a/mingw-w64-djvulibre/PKGBUILD
+++ b/mingw-w64-djvulibre/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Suite to create, manipulate and view DjVu (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://djvu.sourceforge.io/"
+msys2_references=(
+  "cpe: cpe:/a:djvulibre_project:djvulibre"
+)
 license=("GPL")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-pkgconf"
diff --git a/mingw-w64-doxygen/PKGBUILD b/mingw-w64-doxygen/PKGBUILD
index 1822682b24..40d73863f9 100644
--- a/mingw-w64-doxygen/PKGBUILD
+++ b/mingw-w64-doxygen/PKGBUILD
@@ -12,6 +12,7 @@ url="https://www.doxygen.nl/"
 msys2_repository_url="https://github.com/doxygen/doxygen"
 msys2_references=(
   'archlinux: doxygen'
+  "cpe: cpe:/a:doxygen:doxygen"
 )
 license=('spdx:GPL-2.0-only')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-duktape/PKGBUILD b/mingw-w64-duktape/PKGBUILD
index eda6a1f748..784bf3fd39 100644
--- a/mingw-w64-duktape/PKGBUILD
+++ b/mingw-w64-duktape/PKGBUILD
@@ -7,6 +7,9 @@ pkgver=2.7.0
 pkgrel=1
 pkgdesc='Embeddable Javascript engine (mingw-w64)'
 url='https://duktape.org/'
+msys2_references=(
+  "cpe: cpe:/a:duktape_project:duktape"
+)
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=("MIT")
diff --git a/mingw-w64-emacs/PKGBUILD b/mingw-w64-emacs/PKGBUILD
index 8a8e544455..56c07a3d42 100644
--- a/mingw-w64-emacs/PKGBUILD
+++ b/mingw-w64-emacs/PKGBUILD
@@ -15,6 +15,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.gnu.org/software/${_realname}/"
 msys2_references=(
   'archlinux: emacs'
+  "cpe: cpe:/a:gnu:emacs"
 )
 license=('spdx:GPL-3.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-ctags"
diff --git a/mingw-w64-eog/PKGBUILD b/mingw-w64-eog/PKGBUILD
index e2d4cbe546..274a776c5f 100644
--- a/mingw-w64-eog/PKGBUILD
+++ b/mingw-w64-eog/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://wiki.gnome.org/Apps/EyeOfGnome"
 msys2_repository_url="https://gitlab.gnome.org/GNOME/eog"
+msys2_references=(
+  "cpe: cpe:/a:gnome:eog"
+)
 license=("spdx:GPL-2.0-or-later")
 depends=("${MINGW_PACKAGE_PREFIX}-adwaita-icon-theme"
          "${MINGW_PACKAGE_PREFIX}-gettext"
diff --git a/mingw-w64-evince/PKGBUILD b/mingw-w64-evince/PKGBUILD
index e1d8595c15..a5c651f423 100644
--- a/mingw-w64-evince/PKGBUILD
+++ b/mingw-w64-evince/PKGBUILD
@@ -10,6 +10,9 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 pkgdesc="Document (PostScript, PDF) viewer (mingw-w64)"
 url="https://wiki.gnome.org/Apps/Evince"
 msys2_repository_url="https://gitlab.gnome.org/GNOME/evince"
+msys2_references=(
+  "cpe: cpe:/a:gnome:evince"
+)
 license=("spdx:GPL-2.0-or-later")
 depends=("${MINGW_PACKAGE_PREFIX}-glib2"
          "${MINGW_PACKAGE_PREFIX}-cairo"
diff --git a/mingw-w64-exiv2-0.27/PKGBUILD b/mingw-w64-exiv2-0.27/PKGBUILD
index bdc2e5741b..ab4c1a648a 100644
--- a/mingw-w64-exiv2-0.27/PKGBUILD
+++ b/mingw-w64-exiv2-0.27/PKGBUILD
@@ -11,6 +11,10 @@ pkgdesc="Exif/IPTC/Xmp C++ metadata library and tools (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64')
 url='https://exiv2.org/'
+msys2_references=(
+  "cpe: cpe:/a:andreas_huggel:exiv2"
+  "cpe: cpe:/a:exiv2:exiv2"
+)
 license=('spdx:GPL-2.0-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-exiv2/PKGBUILD b/mingw-w64-exiv2/PKGBUILD
index 181e37ef24..ed304dd0b8 100644
--- a/mingw-w64-exiv2/PKGBUILD
+++ b/mingw-w64-exiv2/PKGBUILD
@@ -14,7 +14,8 @@ url='https://exiv2.org/'
 msys2_repository_url="https://github.com/Exiv2/exiv2"
 msys2_references=(
   'archlinux: exiv2'
-  'cpe: cpe:/a:exiv2:exiv2'
+  "cpe: cpe:/a:andreas_huggel:exiv2"
+  "cpe: cpe:/a:exiv2:exiv2"
 )
 license=('spdx:GPL-2.0-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-expat/PKGBUILD b/mingw-w64-expat/PKGBUILD
index 8394918ddb..b663d33f99 100644
--- a/mingw-w64-expat/PKGBUILD
+++ b/mingw-w64-expat/PKGBUILD
@@ -11,6 +11,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://libexpat.github.io/"
 msys2_repository_url="https://github.com/libexpat/libexpat"
+msys2_references=(
+  "cpe: cpe:/a:libexpat_project:libexpat"
+)
 license=('spdx:MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 options=('strip' 'staticlibs')
diff --git a/mingw-w64-faad2/PKGBUILD b/mingw-w64-faad2/PKGBUILD
index 39a46bbce8..3f976aa0bf 100644
--- a/mingw-w64-faad2/PKGBUILD
+++ b/mingw-w64-faad2/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="ISO AAC audio decoder (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/knik0/faad2"
+msys2_references=(
+  "cpe: cpe:/a:audiocoding:faad2"
+  "cpe: cpe:/a:faad2_project:faad2"
+)
 license=('spdx:GPL-2.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-ffmpeg/PKGBUILD b/mingw-w64-ffmpeg/PKGBUILD
index 296e548974..8557249a9e 100644
--- a/mingw-w64-ffmpeg/PKGBUILD
+++ b/mingw-w64-ffmpeg/PKGBUILD
@@ -13,6 +13,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://ffmpeg.org/"
 msys2_repository_url='https://git.ffmpeg.org/ffmpeg.git'
+msys2_references=(
+  "cpe: cpe:/a:ffmpeg:ffmpeg"
+)
 license=('spdx:GPL-3.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-aom"
          "${MINGW_PACKAGE_PREFIX}-bzip2"
diff --git a/mingw-w64-ffmpeg4.4/PKGBUILD b/mingw-w64-ffmpeg4.4/PKGBUILD
index 9bd5d2ac2a..48fa1f99cc 100644
--- a/mingw-w64-ffmpeg4.4/PKGBUILD
+++ b/mingw-w64-ffmpeg4.4/PKGBUILD
@@ -12,6 +12,9 @@ pkgdesc="Complete solution to record, convert and stream audio and video (mingw-
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://ffmpeg.org/"
+msys2_references=(
+  "cpe: cpe:/a:ffmpeg:ffmpeg"
+)
 license=('spdx:GPL-3.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-aom"
          "${MINGW_PACKAGE_PREFIX}-bzip2"
diff --git a/mingw-w64-file/PKGBUILD b/mingw-w64-file/PKGBUILD
index c8807f4c2a..186080def5 100644
--- a/mingw-w64-file/PKGBUILD
+++ b/mingw-w64-file/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='Determine the type of a file from its contents (mingw-w64)'
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.darwinsys.com/file/'
+msys2_references=(
+  "cpe: cpe:/a:file_project:file"
+)
 license=('BSD')
 depends=(${MINGW_PACKAGE_PREFIX}-bzip2
          ${MINGW_PACKAGE_PREFIX}-libsystre
diff --git a/mingw-w64-filezilla/PKGBUILD b/mingw-w64-filezilla/PKGBUILD
index 317239ce26..d84e30a18c 100644
--- a/mingw-w64-filezilla/PKGBUILD
+++ b/mingw-w64-filezilla/PKGBUILD
@@ -14,6 +14,8 @@ msys2_repository_url="https://svn.filezilla-project.org/filezilla/FileZilla3/"
 msys2_documentation_url="https://wiki.filezilla-project.org/Documentation"
 msys2_references=(
   'archlinux: filezilla'
+  "cpe: cpe:/a:filezilla:filezilla"
+  "cpe: cpe:/a:filezilla-project:filezilla_client"
 )
 license=('spdx:GPL-2.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-firebird/PKGBUILD b/mingw-w64-firebird/PKGBUILD
index 43cd29a943..5a33d7e119 100644
--- a/mingw-w64-firebird/PKGBUILD
+++ b/mingw-w64-firebird/PKGBUILD
@@ -13,6 +13,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64')
 msys2_references=(
   'archlinux: firebird'
+  "cpe: cpe:/a:firebirdsql:firebird"
 )
 msys2_repository_url='https://github.com/FirebirdSQL/firebird/'
 msys2_documentation_url='https://www.firebirdsql.org/en/documentation/'
diff --git a/mingw-w64-flac/PKGBUILD b/mingw-w64-flac/PKGBUILD
index cc58dbefcf..7c2b4f58a6 100644
--- a/mingw-w64-flac/PKGBUILD
+++ b/mingw-w64-flac/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Free Lossless Audio Codec (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://xiph.org/flac/"
+msys2_references=(
+  "cpe: cpe:/a:flac_project:flac"
+)
 license=('custom:Xiph' 'LGPL' 'GPL' 'FDL')
 depends=("${MINGW_PACKAGE_PREFIX}-libogg"
          "${MINGW_PACKAGE_PREFIX}-gettext-runtime"
diff --git a/mingw-w64-flang/PKGBUILD b/mingw-w64-flang/PKGBUILD
index f280accb1f..b5413db62e 100644
--- a/mingw-w64-flang/PKGBUILD
+++ b/mingw-w64-flang/PKGBUILD
@@ -14,6 +14,9 @@ pkgdesc="Fortran frontend for LLVM (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://flang.llvm.org/"
+msys2_references=(
+  "cpe: cpe:/a:llvm:llvm"
+)
 license=("spdx:Apache-2.0 WITH LLVM-exception")
 provides=($([[ ${MINGW_PACKAGE_PREFIX} != *-clang-* ]] || echo "${MINGW_PACKAGE_PREFIX}-fc"))
 depends=("${MINGW_PACKAGE_PREFIX}-clang"
diff --git a/mingw-w64-flif/PKGBUILD b/mingw-w64-flif/PKGBUILD
index 0eb730725e..4f5cf60792 100644
--- a/mingw-w64-flif/PKGBUILD
+++ b/mingw-w64-flif/PKGBUILD
@@ -10,6 +10,10 @@ pkgdesc="Free Lossless Image Format (mingw-w64)"
 arch=(any)
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/FLIF-hub/FLIF"
+msys2_references=(
+  "cpe: cpe:/a:flif:flif"
+  "cpe: cpe:/a:flif:free_lossless_image_format"
+)
 license=('GPL3')
 conflicts=("${MINGW_PACKAGE_PREFIX}-flif-git")
 depends=("${MINGW_PACKAGE_PREFIX}-zlib"
diff --git a/mingw-w64-fluidsynth/PKGBUILD b/mingw-w64-fluidsynth/PKGBUILD
index b460e89b92..bfcc08e1e4 100644
--- a/mingw-w64-fluidsynth/PKGBUILD
+++ b/mingw-w64-fluidsynth/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A real-time software synthesizer based on the SoundFont 2 specification
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.fluidsynth.org/"
+msys2_references=(
+  "cpe: cpe:/a:fluidsynth:fluidsynth"
+)
 license=('spdx:LGPL-2.1-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-glib2"
diff --git a/mingw-w64-fmt/PKGBUILD b/mingw-w64-fmt/PKGBUILD
index 45cd097d3f..31c453465c 100644
--- a/mingw-w64-fmt/PKGBUILD
+++ b/mingw-w64-fmt/PKGBUILD
@@ -14,6 +14,7 @@ url="https://fmt.dev"
 msys2_repository_url="https://github.com/fmtlib/fmt"
 msys2_references=(
   'archlinux: fmt'
+  "cpe: cpe:/a:fmt:fmt"
 )
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
diff --git a/mingw-w64-fontconfig/PKGBUILD b/mingw-w64-fontconfig/PKGBUILD
index 2d05e1ba0d..aba285bc5b 100644
--- a/mingw-w64-fontconfig/PKGBUILD
+++ b/mingw-w64-fontconfig/PKGBUILD
@@ -11,6 +11,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://wiki.freedesktop.org/www/Software/fontconfig/"
 msys2_repository_url="https://gitlab.freedesktop.org/fontconfig/fontconfig"
+msys2_references=(
+  "cpe: cpe:/a:fontconfig_project:fontconfig"
+)
 license=("custom")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-meson"
diff --git a/mingw-w64-fontforge/PKGBUILD b/mingw-w64-fontforge/PKGBUILD
index 1703884a2e..4032bd132b 100644
--- a/mingw-w64-fontforge/PKGBUILD
+++ b/mingw-w64-fontforge/PKGBUILD
@@ -10,6 +10,10 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://fontforge.org/'
 msys2_repository_url="https://github.com/fontforge/fontforge"
+msys2_references=(
+  "cpe: cpe:/a:alexej_kryukov:fontforge"
+  "cpe: cpe:/a:fontforge:fontforge"
+)
 license=('spdx:GPL-3.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-freetype"
          "${MINGW_PACKAGE_PREFIX}-gettext"
diff --git a/mingw-w64-fossil/PKGBUILD b/mingw-w64-fossil/PKGBUILD
index e66e0cc6e0..9e9df4af31 100644
--- a/mingw-w64-fossil/PKGBUILD
+++ b/mingw-w64-fossil/PKGBUILD
@@ -13,6 +13,10 @@ pkgdesc='Simple, high-reliability, distributed software configuration management
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://www.fossil-scm.org/'
+msys2_references=(
+  "cpe: cpe:/a:fossil-scm:fossil"
+  "cpe: cpe:/a:fossil_scm:fossil"
+)
 license=('BSD')
 depends=("${MINGW_PACKAGE_PREFIX}-openssl"
          "${MINGW_PACKAGE_PREFIX}-readline"
diff --git a/mingw-w64-freeimage/PKGBUILD b/mingw-w64-freeimage/PKGBUILD
index 00d18b80eb..ad2a0bc1b8 100644
--- a/mingw-w64-freeimage/PKGBUILD
+++ b/mingw-w64-freeimage/PKGBUILD
@@ -14,6 +14,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 license=('spdx:FreeImage OR GPL-2.0-or-later')
 url="https://freeimage.sourceforge.io/"
+msys2_references=(
+  "cpe: cpe:/a:freeimage_project:freeimage"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-jxrlib"
          "${MINGW_PACKAGE_PREFIX}-libjpeg-turbo"
diff --git a/mingw-w64-freerdp/PKGBUILD b/mingw-w64-freerdp/PKGBUILD
index edc66d78fd..1c9061f26d 100644
--- a/mingw-w64-freerdp/PKGBUILD
+++ b/mingw-w64-freerdp/PKGBUILD
@@ -12,6 +12,7 @@ url="https://www.freerdp.com/"
 msys2_repository_url="https://github.com/FreeRDP/FreeRDP"
 msys2_references=(
   'archlinux: freerdp'
+  "cpe: cpe:/a:freerdp:freerdp"
 )
 license=('spdx:Apache-2.0')
 depends=("${MINGW_PACKAGE_PREFIX}-cairo"
diff --git a/mingw-w64-freetds/PKGBUILD b/mingw-w64-freetds/PKGBUILD
index e2c931259c..d4c7e3c455 100644
--- a/mingw-w64-freetds/PKGBUILD
+++ b/mingw-w64-freetds/PKGBUILD
@@ -16,6 +16,7 @@ msys2_documentation_url='https://www.freetds.org/docs.html'
 msys2_issue_tracker_url='https://github.com/FreeTDS/freetds/issues/'
 msys2_references=(
   'archlinux: freetds'
+  "cpe: cpe:/a:freetds:freetds"
 )
 license=('spdx:LGPL-2.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-freetype/PKGBUILD b/mingw-w64-freetype/PKGBUILD
index eaf5d730cf..1bc0c89a0e 100644
--- a/mingw-w64-freetype/PKGBUILD
+++ b/mingw-w64-freetype/PKGBUILD
@@ -13,6 +13,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: freetype2'
+  "cpe: cpe:/a:freetype:freetype"
 )
 url="https://www.freetype.org/"
 license=('spdx:GPL-2.0-or-later OR FTL')
diff --git a/mingw-w64-fribidi/PKGBUILD b/mingw-w64-fribidi/PKGBUILD
index 22aa4a68d7..6e1692bebd 100644
--- a/mingw-w64-fribidi/PKGBUILD
+++ b/mingw-w64-fribidi/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('LGPL')
 url="https://github.com/fribidi/fribidi/"
+msys2_references=(
+  "cpe: cpe:/a:gnu:fribidi"
+)
 depends=()
 options=('strip' '!libtool' 'staticlibs')
 makedepends=("${MINGW_PACKAGE_PREFIX}-meson"
diff --git a/mingw-w64-gc/PKGBUILD b/mingw-w64-gc/PKGBUILD
index bc33086713..5c786effa2 100644
--- a/mingw-w64-gc/PKGBUILD
+++ b/mingw-w64-gc/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="A garbage collector for C and C++ (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.hboehm.info/gc"
+msys2_references=(
+  "cpe: cpe:/a:bdwgc_project:bdwgc"
+  "cpe: cpe:/a:boehm-demers-weiser:garbage_collector"
+)
 license=("MIT")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-libwinpthread-git"
diff --git a/mingw-w64-gcab/PKGBUILD b/mingw-w64-gcab/PKGBUILD
index 7931398533..aedbdfe55c 100644
--- a/mingw-w64-gcab/PKGBUILD
+++ b/mingw-w64-gcab/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A GObject library to create cabinet files (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url='https://wiki.gnome.org/msitools'
+msys2_references=(
+  "cpe: cpe:/a:gnome:gcab"
+)
 license=('LGPL')
 depends=("${MINGW_PACKAGE_PREFIX}-glib2"
          "${MINGW_PACKAGE_PREFIX}-gettext-runtime"
diff --git a/mingw-w64-gcc/PKGBUILD b/mingw-w64-gcc/PKGBUILD
index aeeade2cb0..837f9080cb 100644
--- a/mingw-w64-gcc/PKGBUILD
+++ b/mingw-w64-gcc/PKGBUILD
@@ -35,6 +35,9 @@ pkgdesc="GCC for the MinGW-w64"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64')
 url="https://gcc.gnu.org"
+msys2_references=(
+  "cpe: cpe:/a:gnu:gcc"
+)
 license=('spdx:GPL-3.0-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-${_realname}"
              $([[ "$_enable_ada" == "yes" ]] && echo "${MINGW_PACKAGE_PREFIX}-${_realname}-ada")
diff --git a/mingw-w64-gdal/PKGBUILD b/mingw-w64-gdal/PKGBUILD
index a097a798f7..ed88752aa8 100644
--- a/mingw-w64-gdal/PKGBUILD
+++ b/mingw-w64-gdal/PKGBUILD
@@ -17,6 +17,8 @@ url="https://gdal.org/"
 msys2_repository_url="https://github.com/OSGeo/gdal"
 msys2_references=(
   'archlinux: gdal'
+  "cpe: cpe:/a:gdal:gdal"
+  "cpe: cpe:/a:osgeo:gdal"
 )
 license=('spdx:MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-gdb/PKGBUILD b/mingw-w64-gdb/PKGBUILD
index a5774f845f..fee31cf0e5 100644
--- a/mingw-w64-gdb/PKGBUILD
+++ b/mingw-w64-gdb/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="GNU Debugger (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32')
 url="https://www.gnu.org/software/gdb/"
+msys2_references=(
+  "cpe: cpe:/a:gnu:gdb"
+)
 license=('spdx:GPL-3.0-or-later')
 groups=($( [[ ${MINGW_PACKAGE_PREFIX} == *-clang-* ]] || echo "${MINGW_PACKAGE_PREFIX}-toolchain" ))
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-gdk-pixbuf2/PKGBUILD b/mingw-w64-gdk-pixbuf2/PKGBUILD
index 8f9eb9bc05..4560beb90d 100644
--- a/mingw-w64-gdk-pixbuf2/PKGBUILD
+++ b/mingw-w64-gdk-pixbuf2/PKGBUILD
@@ -12,6 +12,10 @@ pkgdesc="An image loading library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://gitlab.gnome.org/GNOME/gdk-pixbuf"
+msys2_references=(
+  "cpe: cpe:/a:gnome:gdk-pixbuf"
+  "cpe: cpe:/a:gnome:gdkpixbuf"
+)
 license=('spdx:LGPL-2.1-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-pkgconf"
diff --git a/mingw-w64-gedit/PKGBUILD b/mingw-w64-gedit/PKGBUILD
index e84e7e1832..7c1be71d5a 100644
--- a/mingw-w64-gedit/PKGBUILD
+++ b/mingw-w64-gedit/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A text editor for GNOME (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://gedit-technology.github.io/apps/gedit/"
+msys2_references=(
+  "cpe: cpe:/a:gnome:gedit"
+)
 license=('spdx:GPL-2.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-adwaita-icon-theme"
          "${MINGW_PACKAGE_PREFIX}-libgedit-amtk"
diff --git a/mingw-w64-gegl/PKGBUILD b/mingw-w64-gegl/PKGBUILD
index 76e4035cd6..1825690f8b 100644
--- a/mingw-w64-gegl/PKGBUILD
+++ b/mingw-w64-gegl/PKGBUILD
@@ -14,6 +14,7 @@ url="https://gegl.org/"
 msys2_repository_url="https://gitlab.gnome.org/GNOME/gegl"
 msys2_references=(
   'archlinux: gegl'
+  "cpe: cpe:/a:gegl:gegl"
 )
 license=('spdx:GPL-3.0-or-later AND LGPL-3.0-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-gettext/PKGBUILD b/mingw-w64-gettext/PKGBUILD
index 5041e3df30..cf0b9d1dd2 100644
--- a/mingw-w64-gettext/PKGBUILD
+++ b/mingw-w64-gettext/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="GNU internationalization library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.gnu.org/software/gettext/"
+msys2_references=(
+  "cpe: cpe:/a:gnu:gettext"
+)
 # GPL3 for the package as a whole and LGPL for some parts, see the license files
 license=('spdx:GPL-3.0-or-later AND LGPL-2.1-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-ghostscript/PKGBUILD b/mingw-w64-ghostscript/PKGBUILD
index da1ceb2d92..2da2d94dc4 100644
--- a/mingw-w64-ghostscript/PKGBUILD
+++ b/mingw-w64-ghostscript/PKGBUILD
@@ -9,6 +9,8 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: ghostscript'
+  "cpe: cpe:/a:artifex:ghostscript"
+  "cpe: cpe:/a:artifex:gpl_ghostscript"
 )
 msys2_documentation_url="https://ghostscript.readthedocs.io/"
 msys2_repository_url="https://git.ghostscript.com/?p=ghostpdl.git"
diff --git a/mingw-w64-giflib/PKGBUILD b/mingw-w64-giflib/PKGBUILD
index 23fce5e5a1..779b1d6429 100644
--- a/mingw-w64-giflib/PKGBUILD
+++ b/mingw-w64-giflib/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A library for reading and writing gif images (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://sourceforge.net/projects/giflib"
+msys2_references=(
+  "cpe: cpe:/a:giflib_project:giflib"
+)
 license=("MIT")
 makedepends=(
   "${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-gimp3/PKGBUILD b/mingw-w64-gimp3/PKGBUILD
index a38e59798b..4535eb095c 100644
--- a/mingw-w64-gimp3/PKGBUILD
+++ b/mingw-w64-gimp3/PKGBUILD
@@ -12,6 +12,7 @@ url="https://www.gimp.org/downloads/devel/"
 msys2_repository_url="https://gitlab.gnome.org/GNOME/gimp"
 msys2_references=(
   'aur: gimp-devel'
+  "cpe: cpe:/a:gimp:gimp"
 )
 license=('spdx:GPL-3.0-or-later AND LGPL-3.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-aalib"
diff --git a/mingw-w64-git-lfs/PKGBUILD b/mingw-w64-git-lfs/PKGBUILD
index 4acca6fd0d..f3819c5164 100644
--- a/mingw-w64-git-lfs/PKGBUILD
+++ b/mingw-w64-git-lfs/PKGBUILD
@@ -10,6 +10,9 @@ arch=(any)
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 pkgdesc="An open source Git extension for versioning large files (mingw-w64)"
 url="https://git-lfs.github.com/"
+msys2_references=(
+  "cpe: cpe:/a:git_large_file_storage_project:git_large_file_storage"
+)
 license=('spdx:MIT')
 depends=("git")
 makedepends=("unzip"
diff --git a/mingw-w64-glib-networking/PKGBUILD b/mingw-w64-glib-networking/PKGBUILD
index f2c1f83ba2..8e950190ae 100644
--- a/mingw-w64-glib-networking/PKGBUILD
+++ b/mingw-w64-glib-networking/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Network-related GIO modules for glib (mingw-w64)"
 arch=(any)
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://gitlab.gnome.org/GNOME/glib-networking"
+msys2_references=(
+  "cpe: cpe:/a:gnome:glib-networking"
+)
 license=('spdx:LGPL-2.1-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-meson"
diff --git a/mingw-w64-glib2/PKGBUILD b/mingw-w64-glib2/PKGBUILD
index 9256c3046a..046a757684 100644
--- a/mingw-w64-glib2/PKGBUILD
+++ b/mingw-w64-glib2/PKGBUILD
@@ -9,6 +9,9 @@ pkgname="${MINGW_PACKAGE_PREFIX}-${_realname}"
 pkgver=2.80.0
 pkgrel=1
 url="https://gitlab.gnome.org/GNOME/glib"
+msys2_references=(
+  "cpe: cpe:/a:gnome:glib"
+)
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 pkgdesc="Common C routines used by GTK+ 3 and other libs (mingw-w64)"
diff --git a/mingw-w64-gmime/PKGBUILD b/mingw-w64-gmime/PKGBUILD
index 5fe704dabc..b048be1dce 100644
--- a/mingw-w64-gmime/PKGBUILD
+++ b/mingw-w64-gmime/PKGBUILD
@@ -9,6 +9,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 msys2_references=(
   'archlinux: gmime3'
+  "cpe: cpe:/a:gnome:gmime"
 )
 pkgdesc="Glorious MIME Utility Library (mingw-w64)"
 url="https://www.gnome.org"
diff --git a/mingw-w64-gmp/PKGBUILD b/mingw-w64-gmp/PKGBUILD
index 62e372a3e5..9b9f1cb5dc 100644
--- a/mingw-w64-gmp/PKGBUILD
+++ b/mingw-w64-gmp/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A free library for arbitrary precision arithmetic (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://gmplib.org/"
+msys2_references=(
+  "cpe: cpe:/a:gmplib:gmp"
+)
 license=('LGPL3' 'GPL')
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools" "${MINGW_PACKAGE_PREFIX}-cc")
 source=(https://ftp.gnu.org/gnu/gmp/${_realname}-${pkgver}.tar.xz{,.sig}
diff --git a/mingw-w64-gnucobol/PKGBUILD b/mingw-w64-gnucobol/PKGBUILD
index 29570905b3..e88ba4e59e 100644
--- a/mingw-w64-gnucobol/PKGBUILD
+++ b/mingw-w64-gnucobol/PKGBUILD
@@ -14,6 +14,9 @@ replaces=("${MINGW_PACKAGE_PREFIX}-${_realname}-svn" "${MINGW_PACKAGE_PREFIX}-gn
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64')
 url="https://www.gnu.org/software/gnucobol/"
+msys2_references=(
+  "cpe: cpe:/a:gnucobol_project:gnucobol"
+)
 license=('spdx:GPL-3.0-or-later AND spdx:LGPL-3.0-only')
 # note: the final binaries will call cc, therefore it is a dependency
 depends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-gnuplot/PKGBUILD b/mingw-w64-gnuplot/PKGBUILD
index dd987c61c9..5d4bb8cbf0 100644
--- a/mingw-w64-gnuplot/PKGBUILD
+++ b/mingw-w64-gnuplot/PKGBUILD
@@ -14,6 +14,8 @@ arch=('any')
 mingw_arch=('mingw64' 'mingw32' 'ucrt64' 'clang64' 'clangarm64') 
 msys2_references=(
   'archlinux: gnuplot'
+  "cpe: cpe:/a:gnuplot:gnuplot"
+  "cpe: cpe:/a:gnuplot_project:gnuplot"
 )
 msys2_repository_url='https://sourceforge.net/p/gnuplot/gnuplot-main/ci/master/tree/'
 msys2_documentation_url='http://www.gnuplot.info/documentation.html'
diff --git a/mingw-w64-gnutls/PKGBUILD b/mingw-w64-gnutls/PKGBUILD
index 0971a7e65f..678464a245 100644
--- a/mingw-w64-gnutls/PKGBUILD
+++ b/mingw-w64-gnutls/PKGBUILD
@@ -11,6 +11,9 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('spdx:GPL-3.0-or-later' 'spdx:LGPL-2.1-or-later')
 url="https://www.gnutls.org/"
 msys2_repository_url="https://gitlab.com/gnutls/gnutls"
+msys2_references=(
+  "cpe: cpe:/a:gnu:gnutls"
+)
 options=('!zipman')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-gettext-runtime"
diff --git a/mingw-w64-go/PKGBUILD b/mingw-w64-go/PKGBUILD
index c741144b25..43fdf0c736 100644
--- a/mingw-w64-go/PKGBUILD
+++ b/mingw-w64-go/PKGBUILD
@@ -11,6 +11,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: go'
+  "cpe: cpe:/a:golang:go"
 )
 license=('spdx:BSD-3-Clause')
 msys2_repository_url='https://github.com/golang/go/'
diff --git a/mingw-w64-godot/PKGBUILD b/mingw-w64-godot/PKGBUILD
index 9a58c43f6b..94d3999dd8 100644
--- a/mingw-w64-godot/PKGBUILD
+++ b/mingw-w64-godot/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc='An advanced, feature packed, multi-platform 2D and 3D game engine (ming
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64')
 url="https://www.godotengine.org/"
+msys2_references=(
+  "cpe: cpe:/a:godotengine:godot"
+  "cpe: cpe:/a:godotengine:godot_engine"
+)
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-brotli"
          "${MINGW_PACKAGE_PREFIX}-bullet"
diff --git a/mingw-w64-gpgme/PKGBUILD b/mingw-w64-gpgme/PKGBUILD
index 9b9dc2c066..cba60e7188 100644
--- a/mingw-w64-gpgme/PKGBUILD
+++ b/mingw-w64-gpgme/PKGBUILD
@@ -18,6 +18,7 @@ url="https://gnupg.org/related_software/gpgme/"
 msys2_repository_url="https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gpgme.git"
 msys2_references=(
   'archlinux: gpgme'
+  "cpe: cpe:/a:gnu:gpgme"
 )
 license=('spdx: LGPL-2.1-or-later OR GPL-2.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-glib2"
diff --git a/mingw-w64-graphicsmagick/PKGBUILD b/mingw-w64-graphicsmagick/PKGBUILD
index b4e55ef62c..644b43b49b 100644
--- a/mingw-w64-graphicsmagick/PKGBUILD
+++ b/mingw-w64-graphicsmagick/PKGBUILD
@@ -10,7 +10,8 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="http://www.graphicsmagick.org/"
 msys2_references=(
-  'cpe: cpe:/a:graphicsmagick:graphicsmagick'
+  "cpe: cpe:/a:graphicsmagick:graphicsmagick"
+  "cpe: cpe:/a:imagemagick:graphicsmagick"
 )
 license=("spdx:MIT")
 makedepends=("${MINGW_PACKAGE_PREFIX}-ghostscript"
diff --git a/mingw-w64-graphite2/PKGBUILD b/mingw-w64-graphite2/PKGBUILD
index d75d59935c..79f8904253 100644
--- a/mingw-w64-graphite2/PKGBUILD
+++ b/mingw-w64-graphite2/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: graphite'
+  "cpe: cpe:/a:sil:graphite2"
 )
 url="https://github.com/silnrsi/graphite"
 license=('spdx:LGPL-2.1-or-later')
diff --git a/mingw-w64-grep/PKGBUILD b/mingw-w64-grep/PKGBUILD
index c1b1402340..6b64e729b5 100644
--- a/mingw-w64-grep/PKGBUILD
+++ b/mingw-w64-grep/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Grep searches one or more input files for lines containing a match to a
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.gnu.org/software/grep/'
+msys2_references=(
+  "cpe: cpe:/a:gnu:grep"
+)
 license=('GPL3')
 depends=("${MINGW_PACKAGE_PREFIX}-gettext"
          "${MINGW_PACKAGE_PREFIX}-pcre2")
diff --git a/mingw-w64-grpc/PKGBUILD b/mingw-w64-grpc/PKGBUILD
index 904d316b8b..fcda1f37c2 100644
--- a/mingw-w64-grpc/PKGBUILD
+++ b/mingw-w64-grpc/PKGBUILD
@@ -15,6 +15,7 @@ url='https://www.grpc.io/'
 msys2_repository_url="https://github.com/grpc/grpc"
 msys2_references=(
   'archlinux: grpc'
+  "cpe: cpe:/a:grpc:grpc"
 )
 license=('spdx:Apache-2.0')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-gsoap/PKGBUILD b/mingw-w64-gsoap/PKGBUILD
index b172cb7c99..940c188ec9 100644
--- a/mingw-w64-gsoap/PKGBUILD
+++ b/mingw-w64-gsoap/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="An extensive suite of portable C and C++ software to develop XML Web se
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://www.genivia.com/dev.html'
+msys2_references=(
+  "cpe: cpe:/a:genivia:gsoap"
+)
 license=('spdx:GPL-2.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-openssl")
diff --git a/mingw-w64-gst-plugins-bad/PKGBUILD b/mingw-w64-gst-plugins-bad/PKGBUILD
index 535a8d0104..a3b9c7152a 100644
--- a/mingw-w64-gst-plugins-bad/PKGBUILD
+++ b/mingw-w64-gst-plugins-bad/PKGBUILD
@@ -13,6 +13,9 @@ pkgdesc="GStreamer Multimedia Framework Bad Plugins (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://gstreamer.freedesktop.org/"
+msys2_references=(
+  "cpe: cpe:/a:freedesktop:gst-plugins-bad"
+)
 license=("spdx:LGPL-2.1-or-later")
 makedepends=(
   "${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-gst-rtsp-server/PKGBUILD b/mingw-w64-gst-rtsp-server/PKGBUILD
index d044d4e48a..968d417683 100644
--- a/mingw-w64-gst-rtsp-server/PKGBUILD
+++ b/mingw-w64-gst-rtsp-server/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="GStreamer RTSP server library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://gstreamer.freedesktop.org/"
+msys2_references=(
+  "cpe: cpe:/a:gstreamer_project:gst-rtsp-server"
+)
 license=("LGPL")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-meson"
diff --git a/mingw-w64-gstreamer/PKGBUILD b/mingw-w64-gstreamer/PKGBUILD
index 7d3573c396..5e49ec5f9d 100644
--- a/mingw-w64-gstreamer/PKGBUILD
+++ b/mingw-w64-gstreamer/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="GStreamer Multimedia Framework (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://gstreamer.freedesktop.org/"
+msys2_references=(
+  "cpe: cpe:/a:gstreamer:gstreamer"
+  "cpe: cpe:/a:gstreamer_project:gstreamer"
+)
 license=("LGPL")
 makedepends=("${MINGW_PACKAGE_PREFIX}-gobject-introspection"
              "${MINGW_PACKAGE_PREFIX}-gtk-doc"
diff --git a/mingw-w64-gtk-vnc/PKGBUILD b/mingw-w64-gtk-vnc/PKGBUILD
index 671a3151f2..75641ec72c 100644
--- a/mingw-w64-gtk-vnc/PKGBUILD
+++ b/mingw-w64-gtk-vnc/PKGBUILD
@@ -25,6 +25,9 @@ makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
 options=('strip' 'staticlibs')
 license=("GPL 2.1")
 url="https://www.gnome.org"
+msys2_references=(
+  "cpe: cpe:/a:gnome:gtk-vnc"
+)
 source=(https://download.gnome.org/sources/${_realname}/${pkgver%.*}/${_realname}-${pkgver}.tar.xz
         gvncviewer-1.2.0.patch
         001-fix-keymapgen-call.patch)
diff --git a/mingw-w64-gtk2/PKGBUILD b/mingw-w64-gtk2/PKGBUILD
index 9a439555f3..d276ef46bc 100644
--- a/mingw-w64-gtk2/PKGBUILD
+++ b/mingw-w64-gtk2/PKGBUILD
@@ -10,6 +10,10 @@ pkgdesc="GTK+ is a multi-platform toolkit (v2) (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.gtk.org/"
+msys2_references=(
+  "cpe: cpe:/a:gnome:gtk"
+  "cpe: cpe:/a:gtk:gtk%2b"
+)
 
 # According to gtk/gtk.h, this is either LGPL2+ or LGPL2.1+, if that makes any
 # difference. So let's stick to LGPL2.1+ for safety.
diff --git a/mingw-w64-gtk3/PKGBUILD b/mingw-w64-gtk3/PKGBUILD
index c0584e3a31..0ffbd2efff 100644
--- a/mingw-w64-gtk3/PKGBUILD
+++ b/mingw-w64-gtk3/PKGBUILD
@@ -12,6 +12,8 @@ url="https://www.gtk.org/"
 msys2_repository_url="https://gitlab.gnome.org/GNOME/gtk/-/tree/gtk-3-24"
 msys2_references=(
   'archlinux: gtk3'
+  "cpe: cpe:/a:gnome:gtk"
+  "cpe: cpe:/a:gtk:gtk%2b"
 )
 license=("spdx:LGPL-2.1-or-later")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-gtk4/PKGBUILD b/mingw-w64-gtk4/PKGBUILD
index de307c0e22..d1cbf79c86 100644
--- a/mingw-w64-gtk4/PKGBUILD
+++ b/mingw-w64-gtk4/PKGBUILD
@@ -11,6 +11,10 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.gtk.org"
 msys2_repository_url="https://gitlab.gnome.org/GNOME/gtk/"
+msys2_references=(
+  "cpe: cpe:/a:gnome:gtk"
+  "cpe: cpe:/a:gtk:gtk%2b"
+)
 license=('spdx:LGPL-2.1-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-pkgconf"
diff --git a/mingw-w64-guile1.8/PKGBUILD b/mingw-w64-guile1.8/PKGBUILD
index 68105587e8..84dfdf2432 100644
--- a/mingw-w64-guile1.8/PKGBUILD
+++ b/mingw-w64-guile1.8/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="a portable, embeddable Scheme implementation written in C (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'clang32')
 url="https://www.gnu.org/software/guile/"
+msys2_references=(
+  "cpe: cpe:/a:gnu:guile"
+)
 license=('spdx:LGPL-2.1-or-later')
 makedepends=(
     "${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-harfbuzz/PKGBUILD b/mingw-w64-harfbuzz/PKGBUILD
index 2328f5792f..aeeed45a33 100644
--- a/mingw-w64-harfbuzz/PKGBUILD
+++ b/mingw-w64-harfbuzz/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="OpenType text shaping engine (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/harfbuzz/harfbuzz"
+msys2_references=(
+  "cpe: cpe:/a:harfbuzz_project:harfbuzz"
+)
 license=('spdx:MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-meson"
diff --git a/mingw-w64-hdf5/PKGBUILD b/mingw-w64-hdf5/PKGBUILD
index dd1e4ea7c9..e86e0db310 100644
--- a/mingw-w64-hdf5/PKGBUILD
+++ b/mingw-w64-hdf5/PKGBUILD
@@ -14,6 +14,9 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64')
 license=("spdx:BSD-3-Clause-Clear")
 url="https://www.hdfgroup.org/HDF5/"
 msys2_repository_url="https://github.com/HDFGroup/hdf5"
+msys2_references=(
+  "cpe: cpe:/a:hdfgroup:hdf5"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-libaec"
          "${MINGW_PACKAGE_PREFIX}-zlib"
diff --git a/mingw-w64-hexchat/PKGBUILD b/mingw-w64-hexchat/PKGBUILD
index aef4dff36f..17bbea9c56 100644
--- a/mingw-w64-hexchat/PKGBUILD
+++ b/mingw-w64-hexchat/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://hexchat.github.io/'
 msys2_repository_url="https://github.com/hexchat/hexchat"
+msys2_references=(
+  "cpe: cpe:/a:hexchat_project:hexchat"
+)
 license=('spdx:GPL-2.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-dbus-glib"
          "${MINGW_PACKAGE_PREFIX}-desktop-file-utils"
diff --git a/mingw-w64-hiredis/PKGBUILD b/mingw-w64-hiredis/PKGBUILD
index 3f71d70043..29a7fd3874 100644
--- a/mingw-w64-hiredis/PKGBUILD
+++ b/mingw-w64-hiredis/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="Minimalistic C client for Redis (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/redis/hiredis"
+msys2_references=(
+  "cpe: cpe:/a:redis:hiredis"
+  "cpe: cpe:/a:redislabs:hiredis"
+)
 license=('spdx:BSD-3-Clause')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-htslib/PKGBUILD b/mingw-w64-htslib/PKGBUILD
index 8cbb1876b1..0eaa86df5c 100644
--- a/mingw-w64-htslib/PKGBUILD
+++ b/mingw-w64-htslib/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="library for high-throughput sequencing data formats (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://github.com/samtools/htslib"
+msys2_references=(
+  "cpe: cpe:/a:htslib:htslib"
+)
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-bzip2"
          "${MINGW_PACKAGE_PREFIX}-curl"
diff --git a/mingw-w64-hugo/PKGBUILD b/mingw-w64-hugo/PKGBUILD
index 39448509cb..fbf3dacdf2 100644
--- a/mingw-w64-hugo/PKGBUILD
+++ b/mingw-w64-hugo/PKGBUILD
@@ -12,6 +12,7 @@ url='https://gohugo.io/'
 msys2_repository_url='https://github.com/gohugoio/hugo/'
 msys2_references=(
   'archlinux: hugo'
+  "cpe: cpe:/a:gohugo:hugo"
 )
 license=('spdx:Apache-2.0')
 makedepends=("${MINGW_PACKAGE_PREFIX}-go" "${MINGW_PACKAGE_PREFIX}-cc" "git")
diff --git a/mingw-w64-hunspell/PKGBUILD b/mingw-w64-hunspell/PKGBUILD
index 89d45451f8..7ac7e806cc 100644
--- a/mingw-w64-hunspell/PKGBUILD
+++ b/mingw-w64-hunspell/PKGBUILD
@@ -14,6 +14,9 @@ pkgdesc="Spell checker and morphological analyzer library and program (mingw-w64
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://hunspell.github.io/"
+msys2_references=(
+  "cpe: cpe:/a:hunspell_project:hunspell"
+)
 # We omit MPL because it cannot be applied to the whole source, see COPYING
 license=(GPL2+ LGPL2.1+)
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" 
diff --git a/mingw-w64-hwloc/PKGBUILD b/mingw-w64-hwloc/PKGBUILD
index 05cda3d849..3ceb6321ca 100644
--- a/mingw-w64-hwloc/PKGBUILD
+++ b/mingw-w64-hwloc/PKGBUILD
@@ -22,6 +22,9 @@ optdepends=("${MINGW_PACKAGE_PREFIX}-cairo"
 options=('!docs')
 license=('spdx:BSD-3-Clause')
 url='https://www.open-mpi.org/projects/hwloc/'
+msys2_references=(
+  "cpe: cpe:/a:open-mpi:hwloc"
+)
 source=(https://www.open-mpi.org/software/hwloc/v${pkgver%.*}/downloads/${_realname}-${pkgver}.tar.bz2
         0001-hwloc-makefile-fix-ldflags.patch)
 sha256sums=('0305dd60c9de2fbe6519fe2a4e8fdc6d3db8de574a0ca7812b92e80c05ae1392'
diff --git a/mingw-w64-icu/PKGBUILD b/mingw-w64-icu/PKGBUILD
index 1dd668a45a..f700b0fa8f 100644
--- a/mingw-w64-icu/PKGBUILD
+++ b/mingw-w64-icu/PKGBUILD
@@ -11,6 +11,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 pkgdesc="International Components for Unicode library (mingw-w64)"
 url="https://icu.unicode.org/home/"
+msys2_references=(
+  "cpe: cpe:/a:icu-project:international_components_for_unicode"
+)
 license=('spdx:ICU')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-indent/PKGBUILD b/mingw-w64-indent/PKGBUILD
index 7f16093d52..605291d82f 100644
--- a/mingw-w64-indent/PKGBUILD
+++ b/mingw-w64-indent/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="C language source code formatting program (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32')
 url="https://www.gnu.org/software/indent/"
+msys2_references=(
+  "cpe: cpe:/a:gnu:indent"
+)
 license=('GPL3')
 depends=("${MINGW_PACKAGE_PREFIX}-gettext")
 makedepends=('tar' 'texinfo-tex' "${MINGW_PACKAGE_PREFIX}-autotools" "${MINGW_PACKAGE_PREFIX}-cc")
diff --git a/mingw-w64-inkscape/PKGBUILD b/mingw-w64-inkscape/PKGBUILD
index 7b046bbf31..b3a1035182 100644
--- a/mingw-w64-inkscape/PKGBUILD
+++ b/mingw-w64-inkscape/PKGBUILD
@@ -12,6 +12,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://inkscape.org/"
 msys2_repository_url="https://gitlab.com/inkscape/inkscape"
+msys2_references=(
+  "cpe: cpe:/a:inkscape:inkscape"
+)
 license=("spdx:GPL-2.0-or-later")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-jack2/PKGBUILD b/mingw-w64-jack2/PKGBUILD
index abd14810d1..373c9db3ba 100644
--- a/mingw-w64-jack2/PKGBUILD
+++ b/mingw-w64-jack2/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='The JACK low-latency audio server (mingw-w64)'
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64')
 url='https://jackaudio.org/'
+msys2_references=(
+  "cpe: cpe:/a:jackaudio:jack2"
+)
 license=('GPL2')
 depends=("${MINGW_PACKAGE_PREFIX}-db"
          "${MINGW_PACKAGE_PREFIX}-libsystre"
diff --git a/mingw-w64-jansson/PKGBUILD b/mingw-w64-jansson/PKGBUILD
index 6a5252b495..18dfda8b90 100644
--- a/mingw-w64-jansson/PKGBUILD
+++ b/mingw-w64-jansson/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="C library for encoding, decoding and manipulating JSON data (mingw-w64)
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.digip.org/jansson/"
+msys2_references=(
+  "cpe: cpe:/a:jansson_project:jansson"
+)
 license=('MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-libwinpthread-git")
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools" "${MINGW_PACKAGE_PREFIX}-cc")
diff --git a/mingw-w64-jasper/PKGBUILD b/mingw-w64-jasper/PKGBUILD
index 81e5b1d1b5..7c5ade03a6 100644
--- a/mingw-w64-jasper/PKGBUILD
+++ b/mingw-w64-jasper/PKGBUILD
@@ -11,6 +11,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_repository_url='https://github.com/jasper-software/jasper'
 url="https://www.ece.uvic.ca/~mdadams/jasper"
+msys2_references=(
+  "cpe: cpe:/a:jasper_project:jasper"
+)
 license=("spdx:JasPer-2.0")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-jbig2dec/PKGBUILD b/mingw-w64-jbig2dec/PKGBUILD
index d8128499c4..d985210152 100644
--- a/mingw-w64-jbig2dec/PKGBUILD
+++ b/mingw-w64-jbig2dec/PKGBUILD
@@ -7,6 +7,9 @@ pkgver=0.20
 pkgrel=1
 pkgdesc='Decoder implementation of the JBIG2 image compression format (mingw-w64)'
 url='https://jbig2dec.com/'
+msys2_references=(
+  "cpe: cpe:/a:artifex:jbig2dec"
+)
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('spdx:AGPL-3.0-or-later')
diff --git a/mingw-w64-jpegoptim/PKGBUILD b/mingw-w64-jpegoptim/PKGBUILD
index 5fd7c9f867..ccd7f86891 100644
--- a/mingw-w64-jpegoptim/PKGBUILD
+++ b/mingw-w64-jpegoptim/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Utility to optimize jpeg files (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/tjko/jpegoptim/"
+msys2_references=(
+  "cpe: cpe:/a:jpegoptim_project:jpegoptim"
+)
 license=('spdx:GPL-3.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-libjpeg-turbo")
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-jq/PKGBUILD b/mingw-w64-jq/PKGBUILD
index 575c39b4e3..a32a2909ba 100644
--- a/mingw-w64-jq/PKGBUILD
+++ b/mingw-w64-jq/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://jqlang.github.io/jq/'
 msys2_repository_url="https://github.com/jqlang/jq"
+msys2_references=(
+  "cpe: cpe:/a:jq_project:jq"
+)
 license=('spdx:MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools" "${MINGW_PACKAGE_PREFIX}-cc")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-json-c/PKGBUILD b/mingw-w64-json-c/PKGBUILD
index 2e366d16ff..b05b6094c9 100644
--- a/mingw-w64-json-c/PKGBUILD
+++ b/mingw-w64-json-c/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 pkgdesc="A JSON implementation in C (mingw-w64)"
 url='https://github.com/json-c/json-c'
+msys2_references=(
+  "cpe: cpe:/a:json-c_project:json-c"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-julia/PKGBUILD b/mingw-w64-julia/PKGBUILD
index 6c04f33781..ed1a9dadc9 100644
--- a/mingw-w64-julia/PKGBUILD
+++ b/mingw-w64-julia/PKGBUILD
@@ -33,6 +33,9 @@ pkgdesc="High-level, high-performance, dynamic programming language for technica
 arch=('any')
 mingw_arch=('mingw64')
 url="https://julialang.org/"
+msys2_references=(
+  "cpe: cpe:/a:julialang:julia"
+)
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-suitesparse"
diff --git a/mingw-w64-kate/PKGBUILD b/mingw-w64-kate/PKGBUILD
index f37d0d111f..9caf5245cf 100644
--- a/mingw-w64-kate/PKGBUILD
+++ b/mingw-w64-kate/PKGBUILD
@@ -11,6 +11,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: kate'
+  "cpe: cpe:/a:kde:kate"
 )
 msys2_repository_url="https://invent.kde.org/utilities/kate/"
 url="https://apps.kde.org/kate/"
diff --git a/mingw-w64-kauth-qt5/PKGBUILD b/mingw-w64-kauth-qt5/PKGBUILD
index 78422d2cf9..26a5ab273b 100644
--- a/mingw-w64-kauth-qt5/PKGBUILD
+++ b/mingw-w64-kauth-qt5/PKGBUILD
@@ -11,6 +11,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: kauth5'
+  "cpe: cpe:/a:kde:kauth"
 )
 pkgdesc="Abstraction to system policy and authentication features (mingw-w64)"
 license=('LGPL')
diff --git a/mingw-w64-kauth/PKGBUILD b/mingw-w64-kauth/PKGBUILD
index 5e4a658d19..5b5d61baa8 100644
--- a/mingw-w64-kauth/PKGBUILD
+++ b/mingw-w64-kauth/PKGBUILD
@@ -11,6 +11,7 @@ arch=('any')
 mingw_arch=('ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: kauth'
+  "cpe: cpe:/a:kde:kauth"
 )
 msys2_repository_url='https://invent.kde.org/frameworks/kauth/'
 url='https://community.kde.org/Frameworks/'
diff --git a/mingw-w64-kconfig-qt5/PKGBUILD b/mingw-w64-kconfig-qt5/PKGBUILD
index b0688613fe..06bd070dcd 100644
--- a/mingw-w64-kconfig-qt5/PKGBUILD
+++ b/mingw-w64-kconfig-qt5/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: kconfig5'
+  "cpe: cpe:/a:kde:kconfig"
 )
 pkgdesc="KConfig provides an advanced configuration system (mingw-w64)"
 license=('LGPL')
diff --git a/mingw-w64-kconfig/PKGBUILD b/mingw-w64-kconfig/PKGBUILD
index 0ba9eb5329..f118a7c02b 100644
--- a/mingw-w64-kconfig/PKGBUILD
+++ b/mingw-w64-kconfig/PKGBUILD
@@ -11,6 +11,7 @@ arch=('any')
 mingw_arch=('ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: kconfig'
+  "cpe: cpe:/a:kde:kconfig"
 )
 msys2_repository_url='https://invent.kde.org/frameworks/kconfig/'
 url='https://community.kde.org/Frameworks/'
diff --git a/mingw-w64-kicad/PKGBUILD b/mingw-w64-kicad/PKGBUILD
index dbb08b4e1e..8a0f36a0b3 100644
--- a/mingw-w64-kicad/PKGBUILD
+++ b/mingw-w64-kicad/PKGBUILD
@@ -17,6 +17,8 @@ url="https://www.kicad.org/"
 msys2_repository_url="https://gitlab.com/kicad/code/kicad"
 msys2_references=(
   'archlinux: kicad'
+  "cpe: cpe:/a:kicad:eda"
+  "cpe: cpe:/a:kicad:kicad_eda"
 )
 license=("spdx:GPL-3.0-or-later")
 groups=("${MINGW_PACKAGE_PREFIX}-eda")
diff --git a/mingw-w64-kimageformats-qt5/PKGBUILD b/mingw-w64-kimageformats-qt5/PKGBUILD
index 4d3802cc09..d7981f815b 100644
--- a/mingw-w64-kimageformats-qt5/PKGBUILD
+++ b/mingw-w64-kimageformats-qt5/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: kimageformats5'
+  "cpe: cpe:/a:kde:kimageformats"
 )
 pkgdesc="Plugins to allow QImage to support extra file formats (mingw-w64)"
 license=('LGPL')
diff --git a/mingw-w64-kimageformats/PKGBUILD b/mingw-w64-kimageformats/PKGBUILD
index d062bbd427..c72e41efbe 100644
--- a/mingw-w64-kimageformats/PKGBUILD
+++ b/mingw-w64-kimageformats/PKGBUILD
@@ -11,6 +11,7 @@ arch=('any')
 mingw_arch=('ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: kimageformats'
+  "cpe: cpe:/a:kde:kimageformats"
 )
 msys2_repository_url='https://invent.kde.org/frameworks/kimageformats/'
 url='https://community.kde.org/Frameworks/'
diff --git a/mingw-w64-ktexteditor-qt5/PKGBUILD b/mingw-w64-ktexteditor-qt5/PKGBUILD
index 97623266b9..52753d7ec1 100644
--- a/mingw-w64-ktexteditor-qt5/PKGBUILD
+++ b/mingw-w64-ktexteditor-qt5/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: ktexteditor5'
+  "cpe: cpe:/a:kde:ktexteditor"
 )
 pkgdesc="Advanced embeddable text editor (mingw-w64)"
 license=('LGPL')
diff --git a/mingw-w64-ktexteditor/PKGBUILD b/mingw-w64-ktexteditor/PKGBUILD
index b099272852..984badea57 100644
--- a/mingw-w64-ktexteditor/PKGBUILD
+++ b/mingw-w64-ktexteditor/PKGBUILD
@@ -11,6 +11,7 @@ arch=('any')
 mingw_arch=('ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: ktexteditor'
+  "cpe: cpe:/a:kde:ktexteditor"
 )
 msys2_repository_url='https://invent.kde.org/frameworks/ktexteditor/'
 url='https://community.kde.org/Frameworks/'
diff --git a/mingw-w64-lame/PKGBUILD b/mingw-w64-lame/PKGBUILD
index abe7b34431..4ed849645b 100644
--- a/mingw-w64-lame/PKGBUILD
+++ b/mingw-w64-lame/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A high quality MPEG Audio Layer III (MP3) encoder (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://lame.sourceforge.io/"
+msys2_references=(
+  "cpe: cpe:/a:lame_project:lame"
+)
 license=("LGPL")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-mpg123"
diff --git a/mingw-w64-lapack/PKGBUILD b/mingw-w64-lapack/PKGBUILD
index 172755c616..57a8b0ef04 100644
--- a/mingw-w64-lapack/PKGBUILD
+++ b/mingw-w64-lapack/PKGBUILD
@@ -19,6 +19,7 @@ url="https://www.netlib.org/lapack"
 msys2_repository_url="https://github.com/Reference-LAPACK/lapack"
 msys2_references=(
   'archlinux: lapack'
+  "cpe: cpe:/a:lapack_project:lapack"
 )
 license=('spdx:BSD-3-Clause')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-lcms/PKGBUILD b/mingw-w64-lcms/PKGBUILD
index bad057d6bd..7f6590b6b5 100644
--- a/mingw-w64-lcms/PKGBUILD
+++ b/mingw-w64-lcms/PKGBUILD
@@ -9,6 +9,11 @@ pkgdesc="Lightweight color management development library/engine (mingw-w64)"
 arch=(any)
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.littlecms.com/"
+msys2_references=(
+  "cpe: cpe:/a:littlecms:lcms"
+  "cpe: cpe:/a:littlecms:little_cms"
+  "cpe: cpe:/a:littlecms:little_cms_color_engine"
+)
 license=("custom")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 depends=("${MINGW_PACKAGE_PREFIX}-libtiff")
diff --git a/mingw-w64-lcms2/PKGBUILD b/mingw-w64-lcms2/PKGBUILD
index 962287acf2..ac0e5fd757 100644
--- a/mingw-w64-lcms2/PKGBUILD
+++ b/mingw-w64-lcms2/PKGBUILD
@@ -10,6 +10,11 @@ pkgdesc="Small-footprint color management engine, version 2 (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.littlecms.com/"
+msys2_references=(
+  "cpe: cpe:/a:littlecms:lcms"
+  "cpe: cpe:/a:littlecms:little_cms"
+  "cpe: cpe:/a:littlecms:little_cms_color_engine"
+)
 license=('spdx:MIT AND GPL-3.0-or-later')
 makedepends=(
   "${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-ldns/PKGBUILD b/mingw-w64-ldns/PKGBUILD
index dd089e9a73..bb53d28bbe 100644
--- a/mingw-w64-ldns/PKGBUILD
+++ b/mingw-w64-ldns/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://www.nlnetlabs.nl/projects/ldns/'
 msys2_repository_url="https://github.com/NLnetLabs/ldns"
+msys2_references=(
+  "cpe: cpe:/a:nlnetlabs:ldns"
+)
 license=('spdx:BSD-3-Clause')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-leocad/PKGBUILD b/mingw-w64-leocad/PKGBUILD
index 7ad4bda782..a7e60ee1f4 100644
--- a/mingw-w64-leocad/PKGBUILD
+++ b/mingw-w64-leocad/PKGBUILD
@@ -11,6 +11,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://leocad.org'
 msys2_repository_url='https://github.com/leozide/leocad'
+msys2_references=(
+  "cpe: cpe:/a:leocad:leocad"
+)
 license=('GPL')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-leptonica/PKGBUILD b/mingw-w64-leptonica/PKGBUILD
index 5697b7fcbb..e1c85c15c9 100644
--- a/mingw-w64-leptonica/PKGBUILD
+++ b/mingw-w64-leptonica/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="An open source C library for efficient image processing and image analy
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='http://www.leptonica.org'
+msys2_references=(
+  "cpe: cpe:/a:leptonica:leptonica"
+)
 license=("spdx:BSD-2-Clause")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 checkdepends=("${MINGW_PACKAGE_PREFIX}-gnuplot")
diff --git a/mingw-w64-lib3mf/PKGBUILD b/mingw-w64-lib3mf/PKGBUILD
index 39358d1996..de99872ec0 100644
--- a/mingw-w64-lib3mf/PKGBUILD
+++ b/mingw-w64-lib3mf/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32')
 msys2_repository_url='https://github.com/3MFConsortium/lib3mf'
 url='https://3mf.io/'
+msys2_references=(
+  "cpe: cpe:/a:3mf:lib3mf"
+)
 license=('spdx:BSD-2-Clause')
 provides=("${MINGW_PACKAGE_PREFIX}-${_realname}-devel")
 conflicts=("${MINGW_PACKAGE_PREFIX}-${_realname}-devel")
diff --git a/mingw-w64-libao/PKGBUILD b/mingw-w64-libao/PKGBUILD
index bb6c44024f..095328052e 100644
--- a/mingw-w64-libao/PKGBUILD
+++ b/mingw-w64-libao/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Cross-platform audio output library and plugins (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://xiph.org/ao/"
+msys2_references=(
+  "cpe: cpe:/a:xiph:libao"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "git" "${MINGW_PACKAGE_PREFIX}-autotools")
 license=('GPL')
diff --git a/mingw-w64-libarchive/PKGBUILD b/mingw-w64-libarchive/PKGBUILD
index 4543d69072..760d166b10 100644
--- a/mingw-w64-libarchive/PKGBUILD
+++ b/mingw-w64-libarchive/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Multi-format archive and compression library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.libarchive.org/"
+msys2_references=(
+  "cpe: cpe:/a:libarchive:libarchive"
+)
 license=("BSD")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 depends=(${MINGW_PACKAGE_PREFIX}-gcc-libs
diff --git a/mingw-w64-libass/PKGBUILD b/mingw-w64-libass/PKGBUILD
index 92a8c637ef..dcf098d3e5 100644
--- a/mingw-w64-libass/PKGBUILD
+++ b/mingw-w64-libass/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A portable library for SSA/ASS subtitles rendering (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://github.com/libass/libass'
+msys2_references=(
+  "cpe: cpe:/a:libass_project:libass"
+)
 license=('spdx:ISC')
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools"
              "${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libbluray/PKGBUILD b/mingw-w64-libbluray/PKGBUILD
index 417120c9c8..ac50cb66cc 100644
--- a/mingw-w64-libbluray/PKGBUILD
+++ b/mingw-w64-libbluray/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Library to access Blu-Ray disks for video playback (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.videolan.org/developers/libbluray.html'
+msys2_references=(
+  "cpe: cpe:/a:videolan:libbluray"
+)
 license=('spdx:LGPL-2.1-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-libxml2"
          "${MINGW_PACKAGE_PREFIX}-freetype")
diff --git a/mingw-w64-libbotan/PKGBUILD b/mingw-w64-libbotan/PKGBUILD
index 675067d80b..3ad1add9ad 100644
--- a/mingw-w64-libbotan/PKGBUILD
+++ b/mingw-w64-libbotan/PKGBUILD
@@ -12,6 +12,7 @@ url='https://botan.randombit.net/'
 msys2_repository_url='https://github.com/randombit/botan'
 msys2_references=(
   'archlinux: botan'
+  "cpe: cpe:/a:botan_project:botan"
 )
 license=('spdx:BSD-2-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-libc++/PKGBUILD b/mingw-w64-libc++/PKGBUILD
index 36a07d4996..ffa32d8492 100644
--- a/mingw-w64-libc++/PKGBUILD
+++ b/mingw-w64-libc++/PKGBUILD
@@ -16,6 +16,9 @@ pkgrel=1
 arch=(any)
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://libcxx.llvm.org/"
+msys2_references=(
+  "cpe: cpe:/a:llvm:llvm"
+)
 license=("spdx:Apache-2.0 WITH LLVM-exception")
 groups=($( (( _clangprefix )) && echo "${MINGW_PACKAGE_PREFIX}-toolchain"))
 makedepends=("${MINGW_PACKAGE_PREFIX}-clang"
diff --git a/mingw-w64-libcaca/PKGBUILD b/mingw-w64-libcaca/PKGBUILD
index 28d36cbcba..4ec5702f5b 100644
--- a/mingw-w64-libcaca/PKGBUILD
+++ b/mingw-w64-libcaca/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Color AsCii Art library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/cacalabs/libcaca"
+msys2_references=(
+  "cpe: cpe:/a:libcaca_project:libcaca"
+)
 license=("LGPL")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cppunit"
              "${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libcacard/PKGBUILD b/mingw-w64-libcacard/PKGBUILD
index c09d838b21..4b46a7cdaf 100644
--- a/mingw-w64-libcacard/PKGBUILD
+++ b/mingw-w64-libcacard/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="(Common Access Card) library thar provides emulation of smart cards to
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url='https://gitlab.freedesktop.org/spice/libcacard'
+msys2_references=(
+  "cpe: cpe:/a:libcacard_project:libcacard"
+)
 license=('spdx:LGPL-2.1-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-meson"
              "${MINGW_PACKAGE_PREFIX}-ninja"
diff --git a/mingw-w64-libcdio/PKGBUILD b/mingw-w64-libcdio/PKGBUILD
index ed7253a5f2..0d8b1b7cbb 100644
--- a/mingw-w64-libcdio/PKGBUILD
+++ b/mingw-w64-libcdio/PKGBUILD
@@ -11,6 +11,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('GPL3')
 url="https://www.gnu.org/software/libcdio/"
+msys2_references=(
+  "cpe: cpe:/a:gnu:libcdio"
+)
 options=('staticlibs' 'strip')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-autotools")
diff --git a/mingw-w64-libde265/PKGBUILD b/mingw-w64-libde265/PKGBUILD
index 28ef5f5f9f..b19d446db4 100644
--- a/mingw-w64-libde265/PKGBUILD
+++ b/mingw-w64-libde265/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Open h.265 video codec library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/strukturag/libde265"
+msys2_references=(
+  "cpe: cpe:/a:struktur:libde265"
+)
 license=('spdx:LGPL-3.0-or-later' 'spdx:MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-libebml/PKGBUILD b/mingw-w64-libebml/PKGBUILD
index ff4421948f..d5cfe7e6d2 100644
--- a/mingw-w64-libebml/PKGBUILD
+++ b/mingw-w64-libebml/PKGBUILD
@@ -11,6 +11,9 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('LGPL')
 msys2_repository_url="https://github.com/Matroska-Org/libebml"
 url="https://matroska.org"
+msys2_references=(
+  "cpe: cpe:/a:matroska:libebml"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cmake"
              "${MINGW_PACKAGE_PREFIX}-ninja"
diff --git a/mingw-w64-libevent/PKGBUILD b/mingw-w64-libevent/PKGBUILD
index c9e9185ffb..85eb5ab1d2 100644
--- a/mingw-w64-libevent/PKGBUILD
+++ b/mingw-w64-libevent/PKGBUILD
@@ -10,6 +10,10 @@ pkgdesc="An event notification library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://libevent.org"
+msys2_references=(
+  "cpe: cpe:/a:libevent_project:libevent"
+  "cpe: cpe:/a:niels_provos:libevent"
+)
 license=('BSD')
 depends=("${MINGW_PACKAGE_PREFIX}-libwinpthread-git"
          "${MINGW_PACKAGE_PREFIX}-openssl")
diff --git a/mingw-w64-libexif/PKGBUILD b/mingw-w64-libexif/PKGBUILD
index fc724d4452..0b015d7886 100644
--- a/mingw-w64-libexif/PKGBUILD
+++ b/mingw-w64-libexif/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="A library to parse an EXIF file and read the data from those tags (ming
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://libexif.github.io/"
+msys2_references=(
+  "cpe: cpe:/a:libexif:libexif"
+  "cpe: cpe:/a:libexif_project:libexif"
+)
 license=("LGPL-2.1")
 makedepends=("${MINGW_PACKAGE_PREFIX}-pkgconf" "${MINGW_PACKAGE_PREFIX}-autotools" "${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-gettext-tools")
 depends=("${MINGW_PACKAGE_PREFIX}-gettext-runtime")
diff --git a/mingw-w64-libffi/PKGBUILD b/mingw-w64-libffi/PKGBUILD
index 1629e25468..9c9eb79155 100644
--- a/mingw-w64-libffi/PKGBUILD
+++ b/mingw-w64-libffi/PKGBUILD
@@ -14,6 +14,9 @@ options=('staticlibs' 'strip')
 license=('MIT')
 url="https://sourceware.org/libffi"
 msys2_repository_url="https://github.com/libffi/libffi"
+msys2_references=(
+  "cpe: cpe:/a:libffi_project:libffi"
+)
 source=("https://github.com/libffi/libffi/releases/download/v$pkgver/libffi-$pkgver.tar.gz")
 sha256sums=('b0dea9df23c863a7a50e825440f3ebffabd65df1497108e5d437747843895a4e')
 
diff --git a/mingw-w64-libfreexl/PKGBUILD b/mingw-w64-libfreexl/PKGBUILD
index 35d8e425ff..2e482b9f10 100644
--- a/mingw-w64-libfreexl/PKGBUILD
+++ b/mingw-w64-libfreexl/PKGBUILD
@@ -12,6 +12,10 @@ pkgdesc="Library to extract valid data from within an Excel (.xls) spreadsheet (
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.gaia-gis.it/fossil/freexl"
+msys2_references=(
+  "cpe: cpe:/a:freexl_project:freexl"
+  "cpe: cpe:/a:gaia-gis:freexl"
+)
 license=('MPL' 'GPL' 'LGPL')
 depends=("${MINGW_PACKAGE_PREFIX}-expat"
          "${MINGW_PACKAGE_PREFIX}-libiconv"
diff --git a/mingw-w64-libgadu/PKGBUILD b/mingw-w64-libgadu/PKGBUILD
index 68aa8ff707..66aa8e6368 100644
--- a/mingw-w64-libgadu/PKGBUILD
+++ b/mingw-w64-libgadu/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="This library implements the client side of the Gadu-Gadu protocol (ming
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://libgadu.net/"
+msys2_references=(
+  "cpe: cpe:/a:libgadu:libgadu"
+  "cpe: cpe:/a:wojtek_kaniewsk:libgadu"
+)
 license=("LGPL2.1")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 depends=("${MINGW_PACKAGE_PREFIX}-gnutls" "${MINGW_PACKAGE_PREFIX}-protobuf-c")
diff --git a/mingw-w64-libgcrypt/PKGBUILD b/mingw-w64-libgcrypt/PKGBUILD
index e2ed8598fd..e031ab176a 100644
--- a/mingw-w64-libgcrypt/PKGBUILD
+++ b/mingw-w64-libgcrypt/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="General purpose cryptographic library based on the code from GnuPG (min
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://gnupg.org"
+msys2_references=(
+  "cpe: cpe:/a:gnupg:libgcrypt"
+)
 license=('LGPL')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-libgpg-error")
diff --git a/mingw-w64-libgda/PKGBUILD b/mingw-w64-libgda/PKGBUILD
index af61efb1f2..d1f9f81d71 100644
--- a/mingw-w64-libgda/PKGBUILD
+++ b/mingw-w64-libgda/PKGBUILD
@@ -12,6 +12,7 @@ url="https://www.gnome-db.org/"
 msys2_repository_url="https://gitlab.gnome.org/GNOME/libgda"
 msys2_references=(
   'archlinux: libgda'
+  "cpe: cpe:/a:gnome:libgda"
 )
 license=("apdx:LGPL-2.0-only AND GPL-2.0-only")
 depends=("${MINGW_PACKAGE_PREFIX}-cairo"
diff --git a/mingw-w64-libgdata/PKGBUILD b/mingw-w64-libgdata/PKGBUILD
index bef48bfa6f..01bca00199 100644
--- a/mingw-w64-libgdata/PKGBUILD
+++ b/mingw-w64-libgdata/PKGBUILD
@@ -24,6 +24,9 @@ makedepends=("${MINGW_PACKAGE_PREFIX}-gobject-introspection"
 options=('strip' 'staticlibs')
 license=("LGPL 2.1")
 url="https://www.gnome.org/"
+msys2_references=(
+  "cpe: cpe:/a:gnome:libgdata"
+)
 source=(https://download.gnome.org/sources/${_realname}/${pkgver%.*}/${_realname}-${pkgver}.tar.xz
         0003-wsock.patch
         build-fix.patch)
diff --git a/mingw-w64-libgdiplus/PKGBUILD b/mingw-w64-libgdiplus/PKGBUILD
index 89a8ef7f22..1121d8573a 100644
--- a/mingw-w64-libgdiplus/PKGBUILD
+++ b/mingw-w64-libgdiplus/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 license=('MPL' 'LGPL')
 url="https://www.mono-project.com/"
+msys2_references=(
+  "cpe: cpe:/a:mono-project:libgdiplus"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-libtiff"
          "${MINGW_PACKAGE_PREFIX}-cairo"
          "${MINGW_PACKAGE_PREFIX}-fontconfig"
diff --git a/mingw-w64-libgit2/PKGBUILD b/mingw-w64-libgit2/PKGBUILD
index 3d11a86eb7..2b4eb128c2 100644
--- a/mingw-w64-libgit2/PKGBUILD
+++ b/mingw-w64-libgit2/PKGBUILD
@@ -10,6 +10,10 @@ pkgdesc='A linkable library for Git (mingw-w64)'
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://github.com/libgit2/libgit2'
+msys2_references=(
+  "cpe: cpe:/a:libgit2:libgit2"
+  "cpe: cpe:/a:libgit2_project:libgit2"
+)
 license=('GPL2' 'custom')
 depends=("${MINGW_PACKAGE_PREFIX}-http-parser"
          "${MINGW_PACKAGE_PREFIX}-libssh2"
diff --git a/mingw-w64-libgsf/PKGBUILD b/mingw-w64-libgsf/PKGBUILD
index e1109ac492..d3113468f9 100644
--- a/mingw-w64-libgsf/PKGBUILD
+++ b/mingw-w64-libgsf/PKGBUILD
@@ -9,6 +9,8 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 msys2_references=(
   'archlinux: libgsf'
+  "cpe: cpe:/a:gnome:libgsf"
+  "cpe: cpe:/a:libgsf:libgsf"
 )
 pkgdesc="An extensible I/O abstraction library for dealing with structured file formats (mingw-w64)"
 depends=("${MINGW_PACKAGE_PREFIX}-bzip2"
diff --git a/mingw-w64-libgxps/PKGBUILD b/mingw-w64-libgxps/PKGBUILD
index 891797f5c0..cb8d35990e 100644
--- a/mingw-w64-libgxps/PKGBUILD
+++ b/mingw-w64-libgxps/PKGBUILD
@@ -24,6 +24,9 @@ makedepends=("${MINGW_PACKAGE_PREFIX}-meson"
 options=('strip' 'staticlibs')
 license=("LGPL 2.1")
 url="https://www.gnome.org"
+msys2_references=(
+  "cpe: cpe:/a:gnome:libgxps"
+)
 source=(https://download.gnome.org/sources/${_realname}/${pkgver:0:3}/${_realname}-${pkgver}.tar.xz
         001-libgxps-0.3.2-fix_IStream_and_linking.patch)
 sha256sums=('6d27867256a35ccf9b69253eb2a88a32baca3b97d5f4ef7f82e3667fa435251c'
diff --git a/mingw-w64-libheif/PKGBUILD b/mingw-w64-libheif/PKGBUILD
index 59f34b8c5b..0eda01a791 100644
--- a/mingw-w64-libheif/PKGBUILD
+++ b/mingw-w64-libheif/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="HEIF image decoder/encoder library and tools (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/strukturag/libheif"
+msys2_references=(
+  "cpe: cpe:/a:struktur:libheif"
+)
 license=('spdx:LGPL-3.0 AND MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cmake"
              "${MINGW_PACKAGE_PREFIX}-ninja"
diff --git a/mingw-w64-libical/PKGBUILD b/mingw-w64-libical/PKGBUILD
index 11cf443f9b..2e8cae3ef2 100644
--- a/mingw-w64-libical/PKGBUILD
+++ b/mingw-w64-libical/PKGBUILD
@@ -12,6 +12,9 @@ pkgdesc="An Open Source implementation of the iCalendar protocols and protocol d
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64')
 url="https://github.com/libical/libical"
+msys2_references=(
+  "cpe: cpe:/a:libical_project:libical"
+)
 license=("spdx:MPL-2.0 OR LGPL-2.1-only")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-icu"
diff --git a/mingw-w64-libid3tag/PKGBUILD b/mingw-w64-libid3tag/PKGBUILD
index 4bb32f2f32..a71bd8c4c9 100644
--- a/mingw-w64-libid3tag/PKGBUILD
+++ b/mingw-w64-libid3tag/PKGBUILD
@@ -10,6 +10,11 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.underbit.com/products/mad/"
 msys2_repository_url="https://codeberg.org/tenacityteam/libid3tag"
+msys2_references=(
+  "cpe: cpe:/a:libid3tag_project:libid3tag"
+  "cpe: cpe:/a:media-libs:libid3tag"
+  "cpe: cpe:/a:underbit:libid3tag"
+)
 license=("spdx:GPL-2.0-or-later")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-libidn/PKGBUILD b/mingw-w64-libidn/PKGBUILD
index 913d8048cd..8732af3053 100644
--- a/mingw-w64-libidn/PKGBUILD
+++ b/mingw-w64-libidn/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.gnu.org/software/libidn"
 msys2_repository_url="https://gitlab.com/libidn/libidn"
+msys2_references=(
+  "cpe: cpe:/a:gnu:libidn"
+)
 license=('spdx:GPL-3.0-or-later' 'spdx:LGPL-3.0-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools" "${MINGW_PACKAGE_PREFIX}-gtk-doc" "texinfo" "${MINGW_PACKAGE_PREFIX}-gettext-tools")
 depends=("${MINGW_PACKAGE_PREFIX}-gettext-runtime")
diff --git a/mingw-w64-libidn2/PKGBUILD b/mingw-w64-libidn2/PKGBUILD
index afd57d7557..31bb6b405e 100644
--- a/mingw-w64-libidn2/PKGBUILD
+++ b/mingw-w64-libidn2/PKGBUILD
@@ -12,6 +12,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.gnu.org/software/libidn/#libidn2"
 msys2_repository_url="https://gitlab.com/libidn/libidn2"
+msys2_references=(
+  "cpe: cpe:/a:gnu:libidn2"
+)
 license=('spdx:GPL-2.0-or-later' 'spdx:LGPL-3.0-or-later')
 makedepends=(
   "${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libiff/PKGBUILD b/mingw-w64-libiff/PKGBUILD
index 71be4cbb2d..8002f174c6 100644
--- a/mingw-w64-libiff/PKGBUILD
+++ b/mingw-w64-libiff/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Portable, extensible parser for the Interchange File Format (mingw-w64)
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/svanderburg/libiff"
+msys2_references=(
+  "cpe: cpe:/a:libiff_project:libiff"
+)
 license=('spdx:MIT')
 depends=()
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libimobiledevice/PKGBUILD b/mingw-w64-libimobiledevice/PKGBUILD
index de165489ec..d52b612eaf 100644
--- a/mingw-w64-libimobiledevice/PKGBUILD
+++ b/mingw-w64-libimobiledevice/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='A cross-platform protocol library to communicate with iOS devices (ming
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url='https://www.libimobiledevice.org/'
+msys2_references=(
+  "cpe: cpe:/a:libimobiledevice:libimobiledevice"
+)
 license=('spdx:LGPL-2.1-or-later')
 source=(${_realname}-${pkgver}.tar.gz::"https://github.com/libimobiledevice/libimobiledevice/archive/${pkgver}.tar.gz"
         001-1.3.0-Fix-windows-build.patch
diff --git a/mingw-w64-libjpeg-turbo/PKGBUILD b/mingw-w64-libjpeg-turbo/PKGBUILD
index 9e054ca04b..0ab822dd67 100644
--- a/mingw-w64-libjpeg-turbo/PKGBUILD
+++ b/mingw-w64-libjpeg-turbo/PKGBUILD
@@ -12,6 +12,10 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://libjpeg-turbo.virtualgl.org/"
 msys2_repository_url="https://github.com/libjpeg-turbo/libjpeg-turbo"
 msys2_pgp_keys_url="https://libjpeg-turbo.org/Downloads/DigitalSignatures"
+msys2_references=(
+  "cpe: cpe:/a:d.r.commander:libjpeg-turbo"
+  "cpe: cpe:/a:libjpeg-turbo:libjpeg-turbo"
+)
 license=(custom:'BSD-like')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libjxl/PKGBUILD b/mingw-w64-libjxl/PKGBUILD
index 024a731f7b..287cac558c 100644
--- a/mingw-w64-libjxl/PKGBUILD
+++ b/mingw-w64-libjxl/PKGBUILD
@@ -10,6 +10,10 @@ pkgdesc='JPEG XL image format reference implementation (mingw-w64)'
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_repository_url='https://github.com/libjxl/libjxl'
+msys2_references=(
+  "cpe: cpe:/a:jpeg:jpeg-xl"
+  "cpe: cpe:/a:libjxl_project:libjxl"
+)
 url="https://jpeg.org/jpegxl/"
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-brotli"
diff --git a/mingw-w64-libksba/PKGBUILD b/mingw-w64-libksba/PKGBUILD
index 8c8152d2f6..3725984c34 100644
--- a/mingw-w64-libksba/PKGBUILD
+++ b/mingw-w64-libksba/PKGBUILD
@@ -11,6 +11,10 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('GPL')
 url="https://www.gnupg.org/related_software/libksba/"
 msys2_repository_url="https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git"
+msys2_references=(
+  "cpe: cpe:/a:gnupg:libksba"
+  "cpe: cpe:/a:libksba_library:libksba_library"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-libgpg-error")
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools" "${MINGW_PACKAGE_PREFIX}-cc")
 source=("https://gnupg.org/ftp/gcrypt/${_realname}/${_realname}-${pkgver}.tar.bz2"{,.sig})
diff --git a/mingw-w64-libmariadbclient/PKGBUILD b/mingw-w64-libmariadbclient/PKGBUILD
index 0ead80549b..adc85a20b6 100644
--- a/mingw-w64-libmariadbclient/PKGBUILD
+++ b/mingw-w64-libmariadbclient/PKGBUILD
@@ -13,6 +13,7 @@ msys2_repository_url="https://github.com/mariadb-corporation/mariadb-connector-c
 msys2_references=(
   'aur: mariadb-connector-c'
   'archlinux'
+  "cpe: cpe:/a:mariadb:mariadb"
 )
 license=('spdx:LGPL-2.1-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libmatroska/PKGBUILD b/mingw-w64-libmatroska/PKGBUILD
index f582825bb7..1692a20c6f 100644
--- a/mingw-w64-libmatroska/PKGBUILD
+++ b/mingw-w64-libmatroska/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('LGPL')
 url="https://matroska.org"
+msys2_references=(
+  "cpe: cpe:/a:matroska:libmatroska"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-libebml")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cmake"
              "${MINGW_PACKAGE_PREFIX}-ninja"
diff --git a/mingw-w64-libmaxminddb/PKGBUILD b/mingw-w64-libmaxminddb/PKGBUILD
index 2d0df62dde..a9b14fed55 100644
--- a/mingw-w64-libmaxminddb/PKGBUILD
+++ b/mingw-w64-libmaxminddb/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="C library for reading MaxMind DB files, including the GeoIP2 databases
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://dev.maxmind.com/geoip/"
+msys2_references=(
+  "cpe: cpe:/a:maxmind:libmaxminddb"
+)
 license=('spdx:Apache-2.0')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libmicrodns/PKGBUILD b/mingw-w64-libmicrodns/PKGBUILD
index 3fee8453f6..b98843f32d 100644
--- a/mingw-w64-libmicrodns/PKGBUILD
+++ b/mingw-w64-libmicrodns/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Minimal mDNS resolver library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/videolabs/libmicrodns"
+msys2_references=(
+  "cpe: cpe:/a:videolabs:libmicrodns"
+)
 license=("LGPL2.1")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-pkgconf"
diff --git a/mingw-w64-libmicrohttpd/PKGBUILD b/mingw-w64-libmicrohttpd/PKGBUILD
index 45b8e0627f..c9a8b9e084 100644
--- a/mingw-w64-libmicrohttpd/PKGBUILD
+++ b/mingw-w64-libmicrohttpd/PKGBUILD
@@ -12,6 +12,9 @@ pkgdesc="GNU libmicrohttpd is a small C library that is supposed to make it easy
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.gnu.org/software/libmicrohttpd"
+msys2_references=(
+  "cpe: cpe:/a:gnu:libmicrohttpd"
+)
 license=('spdx:LGPL-2.1-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools"
              "${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libmikmod/PKGBUILD b/mingw-w64-libmikmod/PKGBUILD
index 031d156dff..2ddefcebcb 100644
--- a/mingw-w64-libmikmod/PKGBUILD
+++ b/mingw-w64-libmikmod/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="A portable sound library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://mikmod.sourceforge.io/"
+msys2_references=(
+  "cpe: cpe:/a:igno_saitz:libmikmod"
+  "cpe: cpe:/a:raphael_assenat:libmikmod"
+)
 license=("GPL" "LGPL")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-libmodbus-git/PKGBUILD b/mingw-w64-libmodbus-git/PKGBUILD
index 4a3af53109..d52d4a32c4 100644
--- a/mingw-w64-libmodbus-git/PKGBUILD
+++ b/mingw-w64-libmodbus-git/PKGBUILD
@@ -9,6 +9,9 @@ _commit=ebc4f4788678eda8d99e23be87c61a662a9d26b7
 pkgrel=1
 pkgdesc="A Modbus library for Linux, Mac OS X, FreeBSD, QNX and Win32 (mingw-w64)"
 url="https://libmodbus.org/"
+msys2_references=(
+  "cpe: cpe:/a:libmodbus:libmodbus"
+)
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 license=('LGPL')
diff --git a/mingw-w64-libmodplug/PKGBUILD b/mingw-w64-libmodplug/PKGBUILD
index d9aec60948..a78ca90b30 100644
--- a/mingw-w64-libmodplug/PKGBUILD
+++ b/mingw-w64-libmodplug/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A MOD playing library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://modplug-xmms.sourceforge.io/"
+msys2_references=(
+  "cpe: cpe:/a:konstanty_bialkowski:libmodplug"
+)
 license=("custom")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
diff --git a/mingw-w64-libmongoose/PKGBUILD b/mingw-w64-libmongoose/PKGBUILD
index 56ca65144a..affccba269 100644
--- a/mingw-w64-libmongoose/PKGBUILD
+++ b/mingw-w64-libmongoose/PKGBUILD
@@ -12,6 +12,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://github.com/cesanta/mongoose"
 msys2_references=(
   'aur: mongoose'
+  "cpe: cpe:/a:cesanta:mongoose"
 )
 license=('spdx:GPL-2.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc")
diff --git a/mingw-w64-libmysofa/PKGBUILD b/mingw-w64-libmysofa/PKGBUILD
index 0414db4c68..083610657f 100644
--- a/mingw-w64-libmysofa/PKGBUILD
+++ b/mingw-w64-libmysofa/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Reader for AES SOFA files to get better HRTFs (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/hoene/libmysofa/"
+msys2_references=(
+  "cpe: cpe:/a:symonics:libmysofa"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-zlib")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-libntlm/PKGBUILD b/mingw-w64-libntlm/PKGBUILD
index 00091b6db8..85a7aea9a6 100644
--- a/mingw-w64-libntlm/PKGBUILD
+++ b/mingw-w64-libntlm/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Library that implement Microsoft's NTLM authentication (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://gitlab.com/gsasl/libntlm/"
+msys2_references=(
+  "cpe: cpe:/a:nongnu:libntlm"
+)
 license=("spdx:LGPL-2.1-only")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
diff --git a/mingw-w64-libopenmpt/PKGBUILD b/mingw-w64-libopenmpt/PKGBUILD
index 50f39e2278..6dac85a087 100644
--- a/mingw-w64-libopenmpt/PKGBUILD
+++ b/mingw-w64-libopenmpt/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A cross-platform C++ and C library to decode tracked music files (modul
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://lib.openmpt.org"
+msys2_references=(
+  "cpe: cpe:/a:openmpt:libopenmpt"
+)
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-zlib"
           "${MINGW_PACKAGE_PREFIX}-mpg123"
diff --git a/mingw-w64-libotr/PKGBUILD b/mingw-w64-libotr/PKGBUILD
index e5977dc9aa..e11ef35e31 100644
--- a/mingw-w64-libotr/PKGBUILD
+++ b/mingw-w64-libotr/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Off-the-Record Messaging Library and Toolkit (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://www.cypherpunks.ca/otr/"
+msys2_references=(
+  "cpe: cpe:/a:cypherpunks:libotr"
+)
 license=('GPL')
 depends=("${MINGW_PACKAGE_PREFIX}-libgcrypt")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
diff --git a/mingw-w64-libpcap/PKGBUILD b/mingw-w64-libpcap/PKGBUILD
index a88b4c4d8f..c32804735d 100644
--- a/mingw-w64-libpcap/PKGBUILD
+++ b/mingw-w64-libpcap/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A system-independent interface for user-level packet capture (mingw-w64
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.tcpdump.org/"
+msys2_references=(
+  "cpe: cpe:/a:tcpdump:libpcap"
+)
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-openssl")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libpeas/PKGBUILD b/mingw-w64-libpeas/PKGBUILD
index abc0012374..dded574988 100644
--- a/mingw-w64-libpeas/PKGBUILD
+++ b/mingw-w64-libpeas/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="A GObject-based plugins engine (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://wiki.gnome.org/Projects/Libpeas'
+msys2_references=(
+  "cpe: cpe:/a:gnome:libpeas"
+)
 license=('spdx:LGPL-2.1-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-glade"
diff --git a/mingw-w64-libpeas2/PKGBUILD b/mingw-w64-libpeas2/PKGBUILD
index 4f8a570404..ef276ef474 100644
--- a/mingw-w64-libpeas2/PKGBUILD
+++ b/mingw-w64-libpeas2/PKGBUILD
@@ -12,6 +12,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://gitlab.gnome.org/GNOME/libpeas"
 msys2_references=(
   'archlinux: libpeas-2'
+  "cpe: cpe:/a:gnome:libpeas"
 )
 license=("spdx:LGPL-2.1-or-later")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libplist/PKGBUILD b/mingw-w64-libplist/PKGBUILD
index 4f61e3c5fa..63477121ef 100644
--- a/mingw-w64-libplist/PKGBUILD
+++ b/mingw-w64-libplist/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url='https://www.libimobiledevice.org/'
 msys2_repository_url="https://github.com/libimobiledevice/libplist"
+msys2_references=(
+  "cpe: cpe:/a:libimobiledevice:libplist"
+)
 license=('spdx:GPL-2.0-or-later AND spdx:LGPL-2.1-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libpng/PKGBUILD b/mingw-w64-libpng/PKGBUILD
index d91347c7fa..3f15d8693a 100644
--- a/mingw-w64-libpng/PKGBUILD
+++ b/mingw-w64-libpng/PKGBUILD
@@ -15,6 +15,10 @@ makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 license=('custom')
 url="http://www.libpng.org/pub/png/libpng.html"
 msys2_repository_url='https://github.com/pnggroup/libpng'
+msys2_references=(
+  "cpe: cpe:/a:greg_roelofs:libpng"
+  "cpe: cpe:/a:libpng:libpng"
+)
 options=('strip' '!libtool' 'staticlibs')
 # apng: https://github.com/mozilla/gecko-dev/commits/master/media/libpng/apng.patch
 source=("https://downloads.sourceforge.net/sourceforge/libpng/${_realname}-${pkgver}.tar.xz"
diff --git a/mingw-w64-libproxy/PKGBUILD b/mingw-w64-libproxy/PKGBUILD
index 9768fb3c31..abd987e7bd 100644
--- a/mingw-w64-libproxy/PKGBUILD
+++ b/mingw-w64-libproxy/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A library that provides automatic proxy configuration management (mingw
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://libproxy.github.io/libproxy/"
+msys2_references=(
+  "cpe: cpe:/a:libproxy_project:libproxy"
+)
 license=('spdx:LGPL-2.1-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-glib2"
diff --git a/mingw-w64-libressl/PKGBUILD b/mingw-w64-libressl/PKGBUILD
index cf6b47ec4e..4b9491f5e1 100644
--- a/mingw-w64-libressl/PKGBUILD
+++ b/mingw-w64-libressl/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="LibreSSL Encryption (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url='https://www.libressl.org/'
+msys2_references=(
+  "cpe: cpe:/a:openbsd:libressl"
+)
 license=('BSD')
 options=('staticlibs' 'strip')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
diff --git a/mingw-w64-librsvg/PKGBUILD b/mingw-w64-librsvg/PKGBUILD
index 530d572308..4c957de47c 100644
--- a/mingw-w64-librsvg/PKGBUILD
+++ b/mingw-w64-librsvg/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="SVG rendering library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://wiki.gnome.org/Projects/LibRsvg"
+msys2_references=(
+  "cpe: cpe:/a:gnome:librsvg"
+)
 license=("spdx:LGPL-2.1-or-later")
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools"
              "${MINGW_PACKAGE_PREFIX}-gobject-introspection"
diff --git a/mingw-w64-librsync/PKGBUILD b/mingw-w64-librsync/PKGBUILD
index b6d4b05a95..17162b87c8 100644
--- a/mingw-w64-librsync/PKGBUILD
+++ b/mingw-w64-librsync/PKGBUILD
@@ -8,6 +8,9 @@ pkgrel=1
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url='https://librsync.github.io/'
+msys2_references=(
+  "cpe: cpe:/a:librsync_project:librsync"
+)
 pkgdesc="Remote delta-compression library. (mingw-w64)"
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-popt")
diff --git a/mingw-w64-libsamplerate/PKGBUILD b/mingw-w64-libsamplerate/PKGBUILD
index c1ac11c998..d81ff777be 100644
--- a/mingw-w64-libsamplerate/PKGBUILD
+++ b/mingw-w64-libsamplerate/PKGBUILD
@@ -11,6 +11,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('spdx:BSD-2-Clause')
 url='https://libsndfile.github.io/libsamplerate/'
+msys2_references=(
+  "cpe: cpe:/a:libsamplerate_project:libsamplerate"
+)
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
              "${MINGW_PACKAGE_PREFIX}-ninja"
diff --git a/mingw-w64-libsass/PKGBUILD b/mingw-w64-libsass/PKGBUILD
index 431f6f9b43..7df0f48faa 100644
--- a/mingw-w64-libsass/PKGBUILD
+++ b/mingw-w64-libsass/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="C implementation of Sass CSS preprocessor (library) (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://sass-lang.com/libsass"
+msys2_references=(
+  "cpe: cpe:/a:libsass:libsass"
+  "cpe: cpe:/a:sass-lang:libsass"
+)
 license=("MIT")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libshout/PKGBUILD b/mingw-w64-libshout/PKGBUILD
index 327ff04d0b..e75b557b44 100644
--- a/mingw-w64-libshout/PKGBUILD
+++ b/mingw-w64-libshout/PKGBUILD
@@ -10,6 +10,9 @@ arch=(any)
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.icecast.org/"
 msys2_repository_url="https://gitlab.xiph.org/xiph/icecast-libshout"
+msys2_references=(
+  "cpe: cpe:/a:libshout:libshout"
+)
 license=('spdx:LGPL-2.0-only')
 depends=("${MINGW_PACKAGE_PREFIX}-libvorbis"
          "${MINGW_PACKAGE_PREFIX}-libtheora"
diff --git a/mingw-w64-libslirp/PKGBUILD b/mingw-w64-libslirp/PKGBUILD
index 4a405d209c..119abe6e19 100644
--- a/mingw-w64-libslirp/PKGBUILD
+++ b/mingw-w64-libslirp/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="General purpose TCP-IP emulator (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'mingw32' 'ucrt64' 'clang64' 'clangarm64')
 url="https://gitlab.freedesktop.org/slirp/libslirp"
+msys2_references=(
+  "cpe: cpe:/a:libslirp_project:libslirp"
+)
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-glib2")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libsmi/PKGBUILD b/mingw-w64-libsmi/PKGBUILD
index 5c1bc534c0..9bcf6823c1 100644
--- a/mingw-w64-libsmi/PKGBUILD
+++ b/mingw-w64-libsmi/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="C library allowing NM apps and MIB and PIB authoring tools to access SM
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.ibr.cs.tu-bs.de/projects/libsmi/'
+msys2_references=(
+  "cpe: cpe:/a:tu-braunschweig:libsmi"
+)
 license=('Custom')
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools"
              "${MINGW_PACKAGE_PREFIX}-cc")
diff --git a/mingw-w64-libsndfile/PKGBUILD b/mingw-w64-libsndfile/PKGBUILD
index fff9e7390f..d94385e7d7 100644
--- a/mingw-w64-libsndfile/PKGBUILD
+++ b/mingw-w64-libsndfile/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="A C library for reading and writing files containing sampled sound (min
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://libsndfile.github.io/libsndfile/"
+msys2_references=(
+  "cpe: cpe:/a:libsndfile_project:libsndfile"
+  "cpe: cpe:/a:mega-nerd:libsndfile"
+)
 license=('spdx:LGPL-2.1-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-flac"
          "${MINGW_PACKAGE_PREFIX}-lame"
diff --git a/mingw-w64-libsoup/PKGBUILD b/mingw-w64-libsoup/PKGBUILD
index 3f286b20fe..06f4a51459 100644
--- a/mingw-w64-libsoup/PKGBUILD
+++ b/mingw-w64-libsoup/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="HTTP client/server library (mingw-w64)"
 arch=(any)
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://wiki.gnome.org/Projects/libsoup"
+msys2_references=(
+  "cpe: cpe:/a:gnome:libsoup"
+)
 license=("LGPL")
 makedepends=("${MINGW_PACKAGE_PREFIX}-gobject-introspection"
              "${MINGW_PACKAGE_PREFIX}-pkgconf"
diff --git a/mingw-w64-libsoup3/PKGBUILD b/mingw-w64-libsoup3/PKGBUILD
index c2629356ee..9547d511bb 100644
--- a/mingw-w64-libsoup3/PKGBUILD
+++ b/mingw-w64-libsoup3/PKGBUILD
@@ -11,6 +11,7 @@ arch=(any)
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: libsoup3'
+  "cpe: cpe:/a:gnome:libsoup"
 )
 msys2_documentation_url="https://libsoup.org/libsoup-3.0/"
 msys2_repository_url="https://gitlab.gnome.org/GNOME/libsoup/"
diff --git a/mingw-w64-libspiro/PKGBUILD b/mingw-w64-libspiro/PKGBUILD
index ae3bd64180..a61086994e 100644
--- a/mingw-w64-libspiro/PKGBUILD
+++ b/mingw-w64-libspiro/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Simplifies the drawing of beautiful curves (mingw-w64)"
 arch=(any)
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://libspiro.sourceforge.io/"
+msys2_references=(
+  "cpe: cpe:/a:libspiro_project:libspiro"
+)
 license=("GPL")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 options=('staticlibs' 'strip')
diff --git a/mingw-w64-libtasn1/PKGBUILD b/mingw-w64-libtasn1/PKGBUILD
index afaba113a2..a0974ab475 100644
--- a/mingw-w64-libtasn1/PKGBUILD
+++ b/mingw-w64-libtasn1/PKGBUILD
@@ -10,6 +10,10 @@ pkgdesc="A library for Abstract Syntax Notation One (ASN.1) and Distinguish Enco
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.gnu.org/software/libtasn1/"
+msys2_references=(
+  "cpe: cpe:/a:free_software_foundation_inc.:libtasn1"
+  "cpe: cpe:/a:gnu:libtasn1"
+)
 license=("GPL3, LGPL")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-libthai/PKGBUILD b/mingw-w64-libthai/PKGBUILD
index 536763a2e0..bf860a2f72 100644
--- a/mingw-w64-libthai/PKGBUILD
+++ b/mingw-w64-libthai/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Thai language support routines (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://linux.thai.net/projects/libthai"
+msys2_references=(
+  "cpe: cpe:/a:linux.thai:libthai"
+)
 license=('LGPL')
 depends=("${MINGW_PACKAGE_PREFIX}-libdatrie")
 makedepends=("autoconf-archive"
diff --git a/mingw-w64-libtiff/PKGBUILD b/mingw-w64-libtiff/PKGBUILD
index bb99d1522b..7ab336273c 100644
--- a/mingw-w64-libtiff/PKGBUILD
+++ b/mingw-w64-libtiff/PKGBUILD
@@ -12,7 +12,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://libtiff.gitlab.io/libtiff/"
 msys2_references=(
-  'cpe: cpe:/a:libtiff:libtiff'
+  "cpe: cpe:/a:libtiff:libtiff"
+  "cpe: cpe:/a:remotesensing:libtiff"
+  "cpe: cpe:/a:simplesystems:libtiff"
 )
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-libtomcrypt/PKGBUILD b/mingw-w64-libtomcrypt/PKGBUILD
index 96cc1b0dfd..9ca7287b3f 100644
--- a/mingw-w64-libtomcrypt/PKGBUILD
+++ b/mingw-w64-libtomcrypt/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="A fairly comprehensive, modular and portable cryptographic toolkit (min
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://www.libtom.net/LibTomCrypt/"
+msys2_references=(
+  "cpe: cpe:/a:libtom:libtomcrypt"
+  "cpe: cpe:/a:libtomcrypt:libtomcrypt"
+)
 license=('custom')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-gmp"
diff --git a/mingw-w64-libtommath/PKGBUILD b/mingw-w64-libtommath/PKGBUILD
index 1c6aff5d92..faa265236b 100644
--- a/mingw-w64-libtommath/PKGBUILD
+++ b/mingw-w64-libtommath/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Highly optimized and portable routines for integer based number theoret
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://www.libtom.net/LibTomMath/"
+msys2_references=(
+  "cpe: cpe:/a:libtom:libtommath"
+)
 license=('custom')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-libtool")
diff --git a/mingw-w64-libtool/PKGBUILD b/mingw-w64-libtool/PKGBUILD
index e87d6350c2..452edb7245 100644
--- a/mingw-w64-libtool/PKGBUILD
+++ b/mingw-w64-libtool/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="A generic library support script (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.gnu.org/software/libtool"
+msys2_references=(
+  "cpe: cpe:/a:gnu:libtool"
+)
 license=("GPL")
 makedepends=(
   "${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libtorrent-rasterbar/PKGBUILD b/mingw-w64-libtorrent-rasterbar/PKGBUILD
index 4fa482b64d..3bb191db35 100644
--- a/mingw-w64-libtorrent-rasterbar/PKGBUILD
+++ b/mingw-w64-libtorrent-rasterbar/PKGBUILD
@@ -13,6 +13,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 license=('spdx:BSD-3-Clause')
 url="https://libtorrent.org/"
+msys2_references=(
+  "cpe: cpe:/a:rasterbar_software:libtorrent"
+)
 conflicts=("${MINGW_PACKAGE_PREFIX}-${_realname}2")
 replaces=("${MINGW_PACKAGE_PREFIX}-${_realname}2")
 depends=("${MINGW_PACKAGE_PREFIX}-boost"
diff --git a/mingw-w64-libusbmuxd/PKGBUILD b/mingw-w64-libusbmuxd/PKGBUILD
index d6d6561f52..7b4f869015 100644
--- a/mingw-w64-libusbmuxd/PKGBUILD
+++ b/mingw-w64-libusbmuxd/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='A client library to multiplex connections from and to iOS devices (ming
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url='https://www.libimobiledevice.org/'
+msys2_references=(
+  "cpe: cpe:/a:libimobiledevice:libusbmuxd"
+)
 license=('spdx:LGPL-2.1-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools" "${MINGW_PACKAGE_PREFIX}-cc")
 source=(${_realname}-${pkgver}.tar.gz::"https://github.com/libimobiledevice/libusbmuxd/archive/${pkgver}.tar.gz"
diff --git a/mingw-w64-libuv/PKGBUILD b/mingw-w64-libuv/PKGBUILD
index a4d7fefb66..6cda032ff3 100644
--- a/mingw-w64-libuv/PKGBUILD
+++ b/mingw-w64-libuv/PKGBUILD
@@ -11,6 +11,8 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: libuv'
+  "cpe: cpe:/a:libuv:libuv"
+  "cpe: cpe:/a:libuv_project:libuv"
 )
 msys2_documentation_url='https://docs.libuv.org/'
 msys2_repository_url='https://github.com/libuv/libuv/'
diff --git a/mingw-w64-libvirt/PKGBUILD b/mingw-w64-libvirt/PKGBUILD
index 1fe4e0eb0b..862eb77c08 100644
--- a/mingw-w64-libvirt/PKGBUILD
+++ b/mingw-w64-libvirt/PKGBUILD
@@ -14,6 +14,8 @@ msys2_repository_url='https://gitlab.com/libvirt/libvirt/'
 msys2_documentation_url='https://libvirt.org/docs.html'
 msys2_references=(
   'archlinux: libvirt'
+  "cpe: cpe:/a:libvirt:libvirt"
+  "cpe: cpe:/a:redhat:libvirt"
 )
 license=('spdx:LGPL-2.1-or-later OR GPL-2.0-or-later')
 depends=(${MINGW_PACKAGE_PREFIX}-curl
diff --git a/mingw-w64-libvncserver/PKGBUILD b/mingw-w64-libvncserver/PKGBUILD
index fecbd7a9f9..be922158d3 100644
--- a/mingw-w64-libvncserver/PKGBUILD
+++ b/mingw-w64-libvncserver/PKGBUILD
@@ -10,6 +10,11 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://libvnc.github.io/"
 msys2_repository_url="https://github.com/LibVNC/libvncserver"
+msys2_references=(
+  "cpe: cpe:/a:libvnc_project:libvncserver"
+  "cpe: cpe:/a:libvncserver:libvncserver"
+  "cpe: cpe:/a:libvncserver_project:libvncserver"
+)
 license=('spdx:GPL-2.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-gnutls"
diff --git a/mingw-w64-libvorbis/PKGBUILD b/mingw-w64-libvorbis/PKGBUILD
index 633958f8b6..d7ae0f80ac 100644
--- a/mingw-w64-libvorbis/PKGBUILD
+++ b/mingw-w64-libvorbis/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Vorbis codec library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://xiph.org/"
+msys2_references=(
+  "cpe: cpe:/a:xiph.org:libvorbis"
+)
 license=('custom')
 depends=("${MINGW_PACKAGE_PREFIX}-libogg"
          "${MINGW_PACKAGE_PREFIX}-gcc-libs")
diff --git a/mingw-w64-libvpx/PKGBUILD b/mingw-w64-libvpx/PKGBUILD
index 631c0b190c..286f1a4f35 100644
--- a/mingw-w64-libvpx/PKGBUILD
+++ b/mingw-w64-libvpx/PKGBUILD
@@ -18,6 +18,9 @@ makedepends=("${MINGW_PACKAGE_PREFIX}-autotools"
                 || echo "${MINGW_PACKAGE_PREFIX}-yasm" ))
 url="https://www.webmproject.org/"
 msys2_repository_url="https://github.com/webmproject/libvpx"
+msys2_references=(
+  "cpe: cpe:/a:webmproject:libvpx"
+)
 source=(${_realname}-${pkgver}.tar.gz::https://github.com/webmproject/libvpx/archive/v${pkgver}.tar.gz
         0001-enable-shared-on.mingw.patch
         0003-cross-with-native-binutils.mingw.patch
diff --git a/mingw-w64-libvterm/PKGBUILD b/mingw-w64-libvterm/PKGBUILD
index b75a2a30b5..6fcf35c993 100644
--- a/mingw-w64-libvterm/PKGBUILD
+++ b/mingw-w64-libvterm/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='Abstract library implementation of a VT220/xterm/ECMA-48 terminal emula
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://www.leonerd.org.uk/code/libvterm/'
+msys2_references=(
+  "cpe: cpe:/a:leonerd:libvterm"
+)
 license=('spdx:MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-libtool")
 source=("https://launchpad.net/libvterm/trunk/v0.3/+download/libvterm-${pkgver}.tar.gz"
diff --git a/mingw-w64-libwebm/PKGBUILD b/mingw-w64-libwebm/PKGBUILD
index 351cd2b468..e7af81e6d1 100644
--- a/mingw-w64-libwebm/PKGBUILD
+++ b/mingw-w64-libwebm/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="WebM video file parser (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://chromium.googlesource.com/webm/libwebm"
+msys2_references=(
+  "cpe: cpe:/a:webmproject:libwebm"
+)
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-libwebp/PKGBUILD b/mingw-w64-libwebp/PKGBUILD
index 2c7d3e22c2..90ff4bf738 100644
--- a/mingw-w64-libwebp/PKGBUILD
+++ b/mingw-w64-libwebp/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="A library to encode and decode images in WebP format (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://developers.google.com/speed/webp/'
+msys2_references=(
+  "cpe: cpe:/a:webmproject:libwebp"
+)
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-giflib"
          "${MINGW_PACKAGE_PREFIX}-libjpeg-turbo"
diff --git a/mingw-w64-libwmf/PKGBUILD b/mingw-w64-libwmf/PKGBUILD
index 4a63533ad3..0f6e4e9043 100644
--- a/mingw-w64-libwmf/PKGBUILD
+++ b/mingw-w64-libwmf/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="Library for Converting Metafile Images (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://wvWare.sourceforge.io/"
+msys2_references=(
+  "cpe: cpe:/a:francis_james_franklin:libwmf"
+  "cpe: cpe:/a:wvware:libwmf"
+)
 license=("GPL" "LGPL")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-autotools")
diff --git a/mingw-w64-libwpd/PKGBUILD b/mingw-w64-libwpd/PKGBUILD
index cacd989789..f5925e9576 100644
--- a/mingw-w64-libwpd/PKGBUILD
+++ b/mingw-w64-libwpd/PKGBUILD
@@ -9,6 +9,11 @@ pkgdesc="Library for Importing WordPerfect (tm) Documents (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://libwpd.sourceforge.io/"
+msys2_references=(
+  "cpe: cpe:/a:libwpd:libwpd"
+  "cpe: cpe:/a:libwpd:libwpd_library"
+  "cpe: cpe:/a:libwpd_project:libwpd"
+)
 license=('spdx:LGPL-2.1-or-later OR MPL-2.0')
 makedepends=(
   "${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-libxml2/PKGBUILD b/mingw-w64-libxml2/PKGBUILD
index db37e26828..62f62dba61 100644
--- a/mingw-w64-libxml2/PKGBUILD
+++ b/mingw-w64-libxml2/PKGBUILD
@@ -20,6 +20,9 @@ optdepends=("${MINGW_PACKAGE_PREFIX}-python: Python bindings")
 license=('spdx:MIT')
 url="https://gitlab.gnome.org/GNOME/libxml2/-/wikis/home"
 msys2_repository_url="https://gitlab.gnome.org/GNOME/libxml2"
+msys2_references=(
+  "cpe: cpe:/a:xmlsoft:libxml2"
+)
 install=${_realname}-${MSYSTEM}.install
 source=("https://download.gnome.org/sources/libxml2/${pkgver%.*}/${_realname}-${pkgver}.tar.xz"
         https://www.w3.org/XML/Test/xmlts20130923.tar.gz
diff --git a/mingw-w64-libxslt/PKGBUILD b/mingw-w64-libxslt/PKGBUILD
index 537f3a4610..c27c8c29d0 100644
--- a/mingw-w64-libxslt/PKGBUILD
+++ b/mingw-w64-libxslt/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="XML stylesheet transformation library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://gitlab.gnome.org/GNOME/libxslt/-/wikis/home"
+msys2_references=(
+  "cpe: cpe:/a:xmlsoft:libxslt"
+)
 license=('custom')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-libxml2")
diff --git a/mingw-w64-libyaml/PKGBUILD b/mingw-w64-libyaml/PKGBUILD
index 7502eb9b06..2bbdb8d0a6 100644
--- a/mingw-w64-libyaml/PKGBUILD
+++ b/mingw-w64-libyaml/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="YAML 1.1 library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://yaml.org/"
+msys2_references=(
+  "cpe: cpe:/a:pyyaml:libyaml"
+)
 license=("MIT")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 options=('staticlibs' 'strip')
diff --git a/mingw-w64-libzip/PKGBUILD b/mingw-w64-libzip/PKGBUILD
index a15dabf92f..0baeb7fa2c 100644
--- a/mingw-w64-libzip/PKGBUILD
+++ b/mingw-w64-libzip/PKGBUILD
@@ -9,6 +9,10 @@ pkgver=1.10.1
 pkgrel=1
 pkgdesc="A C library for reading, creating, and modifying zip archives (mingw-w64)"
 url="https://libzip.org"
+msys2_references=(
+  "cpe: cpe:/a:libzip:libzip"
+  "cpe: cpe:/a:nih:libzip"
+)
 license=('spdx:BSD-3-Clause')
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
diff --git a/mingw-w64-live-media/PKGBUILD b/mingw-w64-live-media/PKGBUILD
index f6638ff8fe..bb1a76de7a 100644
--- a/mingw-w64-live-media/PKGBUILD
+++ b/mingw-w64-live-media/PKGBUILD
@@ -12,6 +12,10 @@ pkgdesc="A set of C++ libraries for multimedia streaming (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="http://live555.com/liveMedia"
+msys2_references=(
+  "cpe: cpe:/a:live555:liblivemedia"
+  "cpe: cpe:/a:live555:live555"
+)
 license=('spdx:LGPL-3.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-openssl")
diff --git a/mingw-w64-lldb/PKGBUILD b/mingw-w64-lldb/PKGBUILD
index c85ac88241..51f3184222 100644
--- a/mingw-w64-lldb/PKGBUILD
+++ b/mingw-w64-lldb/PKGBUILD
@@ -14,6 +14,9 @@ pkgver=${_version}${_rc/-/}
 pkgrel=1
 pkgdesc="Next generation, high-performance debugger (mingw-w64)"
 url="https://lldb.llvm.org/"
+msys2_references=(
+  "cpe: cpe:/a:llvm:llvm"
+)
 arch=(any)
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=("spdx:Apache-2.0 WITH LLVM-exception")
diff --git a/mingw-w64-llvm-14/PKGBUILD b/mingw-w64-llvm-14/PKGBUILD
index f1da927979..cb840dd138 100644
--- a/mingw-w64-llvm-14/PKGBUILD
+++ b/mingw-w64-llvm-14/PKGBUILD
@@ -22,6 +22,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: llvm14'
+  "cpe: cpe:/a:llvm:llvm"
 )
 url="https://llvm.org/"
 license=("spdx:Apache-2.0 WITH LLVM-exception")
diff --git a/mingw-w64-llvm-15/PKGBUILD b/mingw-w64-llvm-15/PKGBUILD
index 1c298d54f8..00c20a110b 100644
--- a/mingw-w64-llvm-15/PKGBUILD
+++ b/mingw-w64-llvm-15/PKGBUILD
@@ -25,6 +25,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: llvm15'
+  "cpe: cpe:/a:llvm:llvm"
 )
 url="https://llvm.org/"
 license=("spdx:Apache-2.0 WITH LLVM-exception")
diff --git a/mingw-w64-llvm/PKGBUILD b/mingw-w64-llvm/PKGBUILD
index c0e83e95ea..3c8e40a97e 100644
--- a/mingw-w64-llvm/PKGBUILD
+++ b/mingw-w64-llvm/PKGBUILD
@@ -37,6 +37,9 @@ pkgdesc="C language family frontend for LLVM (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://llvm.org/"
+msys2_references=(
+  "cpe: cpe:/a:llvm:llvm"
+)
 license=("spdx:Apache-2.0 WITH LLVM-exception")
 groups=($( (( _clangprefix )) && echo "${MINGW_PACKAGE_PREFIX}-toolchain"))
 makedepends=($([[ "$_compiler" == "clang" ]] && echo \
diff --git a/mingw-w64-lua/PKGBUILD b/mingw-w64-lua/PKGBUILD
index b4347394eb..2c80e1b281 100644
--- a/mingw-w64-lua/PKGBUILD
+++ b/mingw-w64-lua/PKGBUILD
@@ -12,6 +12,9 @@ pkgdesc="A powerful light-weight programming language designed for extending app
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.lua.org/"
+msys2_references=(
+  "cpe: cpe:/a:lua:lua"
+)
 license=('spdx:MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc")
 source=("${url}/ftp/lua-${pkgver}.tar.gz"
diff --git a/mingw-w64-lua51/PKGBUILD b/mingw-w64-lua51/PKGBUILD
index d67a00b115..ca1f6f5060 100644
--- a/mingw-w64-lua51/PKGBUILD
+++ b/mingw-w64-lua51/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="A powerful light-weight programming language designed for extending app
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.lua.org/"
+msys2_references=(
+  "cpe: cpe:/a:lua:lua"
+)
 license=('MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc")
 options=('staticlibs' 'strip' 'emptydirs')
diff --git a/mingw-w64-lua53/PKGBUILD b/mingw-w64-lua53/PKGBUILD
index a23e18568e..0ba0234544 100644
--- a/mingw-w64-lua53/PKGBUILD
+++ b/mingw-w64-lua53/PKGBUILD
@@ -12,6 +12,9 @@ pkgdesc="A powerful light-weight programming language designed for extending app
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://www.lua.org/"
+msys2_references=(
+  "cpe: cpe:/a:lua:lua"
+)
 license=('MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc")
 options=('staticlibs' 'strip' 'emptydirs')
diff --git a/mingw-w64-luajit/PKGBUILD b/mingw-w64-luajit/PKGBUILD
index 9095f4a99e..16ceff4474 100644
--- a/mingw-w64-luajit/PKGBUILD
+++ b/mingw-w64-luajit/PKGBUILD
@@ -14,6 +14,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://luajit.org/"
 msys2_repository_url='https://repo.or.cz/w/luajit-2.0.git'
+msys2_references=(
+  "cpe: cpe:/a:luajit:luajit"
+)
 license=('spdx:MIT')
 conflicts=("${MINGW_PACKAGE_PREFIX}-lua51"
            "${MINGW_PACKAGE_PREFIX}-luajit-git")
diff --git a/mingw-w64-lz4/PKGBUILD b/mingw-w64-lz4/PKGBUILD
index 1a93d9e36e..5e8993b7be 100644
--- a/mingw-w64-lz4/PKGBUILD
+++ b/mingw-w64-lz4/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Very fast lossless compression algorithm (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://lz4.github.io/lz4/"
+msys2_references=(
+  "cpe: cpe:/a:lz4_project:lz4"
+)
 license=('BSD' 'GPL2')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc")
 checkdepends=('diffutils')
diff --git a/mingw-w64-make/PKGBUILD b/mingw-w64-make/PKGBUILD
index 2c97b66452..880c8ea125 100644
--- a/mingw-w64-make/PKGBUILD
+++ b/mingw-w64-make/PKGBUILD
@@ -17,6 +17,9 @@ pkgdesc="GNU make utility to maintain groups of programs (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.gnu.org/software/make"
+msys2_references=(
+  "cpe: cpe:/a:gnu:make"
+)
 license=('GPL3')
 groups=("${MINGW_PACKAGE_PREFIX}-toolchain")
 depends=("${MINGW_PACKAGE_PREFIX}-gettext-runtime")
diff --git a/mingw-w64-mapserver/PKGBUILD b/mingw-w64-mapserver/PKGBUILD
index 2d4aa22daa..2f39a32d89 100644
--- a/mingw-w64-mapserver/PKGBUILD
+++ b/mingw-w64-mapserver/PKGBUILD
@@ -13,6 +13,8 @@ url='https://mapserver.org/'
 msys2_repository_url="https://github.com/MapServer/MapServer"
 msys2_references=(
   'aur: mapserver'
+  "cpe: cpe:/a:osgeo:mapserver"
+  "cpe: cpe:/a:umn:mapserver"
 )
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-zlib"
diff --git a/mingw-w64-matio/PKGBUILD b/mingw-w64-matio/PKGBUILD
index 799a87548a..684065378d 100644
--- a/mingw-w64-matio/PKGBUILD
+++ b/mingw-w64-matio/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: libmatio'
+  "cpe: cpe:/a:matio_project:matio"
 )
 msys2_repository_url='https://github.com/tbeu/matio/'
 url='https://sourceforge.net/projects/matio/'
diff --git a/mingw-w64-mbedtls/PKGBUILD b/mingw-w64-mbedtls/PKGBUILD
index 068b054cdb..9eb4ae064c 100644
--- a/mingw-w64-mbedtls/PKGBUILD
+++ b/mingw-w64-mbedtls/PKGBUILD
@@ -12,6 +12,7 @@ url='https://www.trustedfirmware.org/projects/mbed-tls/'
 msys2_repository_url="https://github.com/ARMmbed/mbedtls"
 msys2_references=(
   'archlinux: mbedtls'
+  "cpe: cpe:/a:arm:mbed_tls"
 )
 license=('spdx:Apache-2.0')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-mcpp/PKGBUILD b/mingw-w64-mcpp/PKGBUILD
index ec75c7a625..4cb07ae408 100644
--- a/mingw-w64-mcpp/PKGBUILD
+++ b/mingw-w64-mcpp/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32')
 license=('custom')
 url="https://mcpp.sourceforge.io/"
+msys2_references=(
+  "cpe: cpe:/a:mcpp_project:mcpp"
+)
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs" "${MINGW_PACKAGE_PREFIX}-libiconv")
 options=('staticlibs' 'strip')
diff --git a/mingw-w64-md4c/PKGBUILD b/mingw-w64-md4c/PKGBUILD
index f2c5fce8e6..cde18faaa6 100644
--- a/mingw-w64-md4c/PKGBUILD
+++ b/mingw-w64-md4c/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="C Markdown parser implementation compliant to CommonMark specification"
 arch=(any)
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/mity/md4c"
+msys2_references=(
+  "cpe: cpe:/a:md4c_project:md4c"
+)
 license=("MIT")
 depends=()
 makedepends=("bsdtar"
diff --git a/mingw-w64-mdbook/PKGBUILD b/mingw-w64-mdbook/PKGBUILD
index c34bb95e03..ceae9e5af9 100644
--- a/mingw-w64-mdbook/PKGBUILD
+++ b/mingw-w64-mdbook/PKGBUILD
@@ -12,6 +12,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://github.com/rust-lang/mdBook"
 msys2_references=(
   'archlinux: mdbook'
+  "cpe: cpe:/a:rust-lang:mdbook"
 )
 license=('spdx:MPL-2.0')
 makedepends=("${MINGW_PACKAGE_PREFIX}-rust")
diff --git a/mingw-w64-mediainfo/PKGBUILD b/mingw-w64-mediainfo/PKGBUILD
index 02a851c6c3..4292693118 100644
--- a/mingw-w64-mediainfo/PKGBUILD
+++ b/mingw-w64-mediainfo/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Supplies technical and tag information about media files (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://mediaarea.net"
+msys2_references=(
+  "cpe: cpe:/a:mediaarea:mediainfo"
+)
 license=("spdx:BSD-2-Clause")
 makedepends=(
   "${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-mesa/PKGBUILD b/mingw-w64-mesa/PKGBUILD
index 48cfca49ee..4edcedf5a8 100644
--- a/mingw-w64-mesa/PKGBUILD
+++ b/mingw-w64-mesa/PKGBUILD
@@ -7,6 +7,9 @@ pkgver=24.0.3
 pkgrel=2
 pkgdesc="Open-source implementation of the OpenGL, Vulkan and OpenCL specifications (mingw-w64)"
 url="https://www.mesa3d.org/"
+msys2_references=(
+  "cpe: cpe:/a:mesa3d:mesa"
+)
 license=('spdx:MIT')
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
diff --git a/mingw-w64-mono/PKGBUILD b/mingw-w64-mono/PKGBUILD
index a414a4b997..018b87d8c8 100644
--- a/mingw-w64-mono/PKGBUILD
+++ b/mingw-w64-mono/PKGBUILD
@@ -13,6 +13,8 @@ msys2_repository_url="https://github.com/mono/mono"
 msys2_references=(
   'archlinux: mono'
   'cpe: cpe:/a:mono:mono'
+  "cpe: cpe:/a:microsoft:mono"
+  "cpe: cpe:/a:mono-project:mono"
 )
 license=('spdx:GPL OR LGPL-2.1 OR MPL')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-mosquitto/PKGBUILD b/mingw-w64-mosquitto/PKGBUILD
index c3c3051a63..7538c19ef7 100644
--- a/mingw-w64-mosquitto/PKGBUILD
+++ b/mingw-w64-mosquitto/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="An Open Source MQTT Broker (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://mosquitto.org"
+msys2_references=(
+  "cpe: cpe:/a:eclipse:mosquitto"
+)
 license=('spdx:EPL-2.0 OR EDL-1.0')
 depends=("${MINGW_PACKAGE_PREFIX}-c-ares"
          "${MINGW_PACKAGE_PREFIX}-cjson"
diff --git a/mingw-w64-mpg123/PKGBUILD b/mingw-w64-mpg123/PKGBUILD
index 00d4193d8a..c7fea08253 100644
--- a/mingw-w64-mpg123/PKGBUILD
+++ b/mingw-w64-mpg123/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A console based real time MPEG Audio Player for Layer 1, 2 and 3 (mingw
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.mpg123.com/"
+msys2_references=(
+  "cpe: cpe:/a:mpg123:mpg123"
+)
 license=('spdx:LGPL-2.1-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-openal"
              "${MINGW_PACKAGE_PREFIX}-portaudio"
diff --git a/mingw-w64-mpv/PKGBUILD b/mingw-w64-mpv/PKGBUILD
index 0919ae2130..5ab3b39b56 100644
--- a/mingw-w64-mpv/PKGBUILD
+++ b/mingw-w64-mpv/PKGBUILD
@@ -9,6 +9,9 @@ pkgrel=1
 pkgdesc="Video player based on MPlayer/mplayer2 (mingw-w64)"
 url="https://mpv.io/"
 msys2_repository_url="https://github.com/mpv-player/mpv"
+msys2_references=(
+  "cpe: cpe:/a:mpv:mpv"
+)
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64')
 license=('spx:GPL-2.0-only' 'spx:LGPL-2.1-only')
diff --git a/mingw-w64-mruby/PKGBUILD b/mingw-w64-mruby/PKGBUILD
index 7433f9510a..666c6df73b 100644
--- a/mingw-w64-mruby/PKGBUILD
+++ b/mingw-w64-mruby/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="mruby is the lightweight implementation of the Ruby language (mingw-w64
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://github.com/mruby/mruby"
+msys2_references=(
+  "cpe: cpe:/a:mruby:mruby"
+)
 license=('spdx:MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-ruby")
diff --git a/mingw-w64-mtools/PKGBUILD b/mingw-w64-mtools/PKGBUILD
index bee210fb1e..204d491268 100644
--- a/mingw-w64-mtools/PKGBUILD
+++ b/mingw-w64-mtools/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="collection of utilities to access FAT filesystems without mounting them
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64')
 url="https://www.gnu.org/software/mtools"
+msys2_references=(
+  "cpe: cpe:/a:mtools:mformat"
+)
 license=('spdx:GPL-3.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-libiconv")
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-mujs/PKGBUILD b/mingw-w64-mujs/PKGBUILD
index fbd3b94a01..1fed92ad94 100644
--- a/mingw-w64-mujs/PKGBUILD
+++ b/mingw-w64-mujs/PKGBUILD
@@ -12,6 +12,9 @@ msys2_references=(
 )
 msys2_repository_url='https://git.ghostscript.com/?p=mujs.git'
 url="http://mujs.com/"
+msys2_references=(
+  "cpe: cpe:/a:artifex:mujs"
+)
 license=('spdx:ISC')
 pkgdesc='A lightweight Javascript interpreter designed for embedding in other software (mingw-w64)'
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-mupdf/PKGBUILD b/mingw-w64-mupdf/PKGBUILD
index 9ef2a04271..aff91ba81e 100644
--- a/mingw-w64-mupdf/PKGBUILD
+++ b/mingw-w64-mupdf/PKGBUILD
@@ -15,6 +15,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: mupdf'
+  "cpe: cpe:/a:artifex:mupdf"
 )
 msys2_repository_url='https://github.com/ArtifexSoftware/mupdf/'
 msys2_documentation_url='https://mupdf.readthedocs.io/'
diff --git a/mingw-w64-mxml/PKGBUILD b/mingw-w64-mxml/PKGBUILD
index 1f676b08fa..0c2253fe5d 100644
--- a/mingw-w64-mxml/PKGBUILD
+++ b/mingw-w64-mxml/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="A tiny XML library for reading and writing XML files (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.msweet.org/mxml/"
+msys2_references=(
+  "cpe: cpe:/a:mini-xml_project:mini-xml"
+  "cpe: cpe:/a:msweet:mini-xml"
+)
 license=('spdx:Apache-2.0')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-libwinpthread-git")
diff --git a/mingw-w64-nasm/PKGBUILD b/mingw-w64-nasm/PKGBUILD
index adf242cadf..7469d76f7a 100644
--- a/mingw-w64-nasm/PKGBUILD
+++ b/mingw-w64-nasm/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 license=('BSD')
 url="https://www.nasm.us"
+msys2_references=(
+  "cpe: cpe:/a:nasm:netwide_assembler"
+)
 options=('strip' '!libtool' 'staticlibs' '!makeflags')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-autotools")
diff --git a/mingw-w64-ncurses/PKGBUILD b/mingw-w64-ncurses/PKGBUILD
index 42c951928f..9724489bad 100644
--- a/mingw-w64-ncurses/PKGBUILD
+++ b/mingw-w64-ncurses/PKGBUILD
@@ -13,6 +13,10 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 depends=("${MINGW_PACKAGE_PREFIX}-libsystre")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 url="https://www.gnu.org/software/ncurses/"
+msys2_references=(
+  "cpe: cpe:/a:gnu:ncurses"
+  "cpe: cpe:/a:ncurses_project:ncurses"
+)
 license=('spdx:MIT')
 options=('staticlibs' 'strip')
 # https://ftp.gnu.org/pub/gnu/ncurses/ncurses-${pkgver}.tar.gz{,.sig}
diff --git a/mingw-w64-neon/PKGBUILD b/mingw-w64-neon/PKGBUILD
index 1059bf15c6..b1d22205d8 100644
--- a/mingw-w64-neon/PKGBUILD
+++ b/mingw-w64-neon/PKGBUILD
@@ -10,6 +10,10 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://notroj.github.io/neon/"
 msys2_repository_url="https://github.com/notroj/neon"
+msys2_references=(
+  "cpe: cpe:/a:neon:neon"
+  "cpe: cpe:/a:webdav:neon"
+)
 license=('spdx:LGPL-2.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-expat"
          "${MINGW_PACKAGE_PREFIX}-gettext"
diff --git a/mingw-w64-nettle/PKGBUILD b/mingw-w64-nettle/PKGBUILD
index 338ceaeff6..729e0e02f7 100644
--- a/mingw-w64-nettle/PKGBUILD
+++ b/mingw-w64-nettle/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A low-level cryptographic library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.lysator.liu.se/~nisse/nettle"
+msys2_references=(
+  "cpe: cpe:/a:nettle_project:nettle"
+)
 license=('spdx:GPL-2.0-or-later' 'spdx:LGPL-3.0-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs" "${MINGW_PACKAGE_PREFIX}-gmp")
diff --git a/mingw-w64-nghttp2/PKGBUILD b/mingw-w64-nghttp2/PKGBUILD
index 7f07b81213..5b5afaaba9 100644
--- a/mingw-w64-nghttp2/PKGBUILD
+++ b/mingw-w64-nghttp2/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://nghttp2.org/'
 msys2_repository_url="https://github.com/nghttp2/nghttp2"
+msys2_references=(
+  "cpe: cpe:/a:nghttp2:nghttp2"
+)
 depends=()
 checkdepends=("${MINGW_PACKAGE_PREFIX}-cunit")
 makedepends=(
diff --git a/mingw-w64-nim/PKGBUILD b/mingw-w64-nim/PKGBUILD
index 24d09038ce..4b450efd4b 100644
--- a/mingw-w64-nim/PKGBUILD
+++ b/mingw-w64-nim/PKGBUILD
@@ -12,6 +12,10 @@ pkgdesc='Imperative, multi-paradigm, compiled programming language (mingw-w64)'
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32')
 url='https://nim-lang.org/'
+msys2_references=(
+  "cpe: cpe:/a:nim-lang:nim"
+  "cpe: cpe:/a:nim-lang:nim-lang"
+)
 license=('MIT')
 makedepends=('git' "${MINGW_PACKAGE_PREFIX}-cc")
 options=(!emptydirs)
diff --git a/mingw-w64-nodejs/PKGBUILD b/mingw-w64-nodejs/PKGBUILD
index 3087c911f5..09935e0e69 100644
--- a/mingw-w64-nodejs/PKGBUILD
+++ b/mingw-w64-nodejs/PKGBUILD
@@ -18,6 +18,8 @@ msys2_repository_url='https://github.com/nodejs/node'
 msys2_documentation_url='https://nodejs.org/download/docs'
 msys2_references=(
   'archlinux: nodejs'
+  "cpe: cpe:/a:nodejs:node.js"
+  "cpe: cpe:/a:nodejs:nodejs"
 )
 license=('spdx:MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-nspr/PKGBUILD b/mingw-w64-nspr/PKGBUILD
index cfc19f49b9..7362f20ddf 100644
--- a/mingw-w64-nspr/PKGBUILD
+++ b/mingw-w64-nspr/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Netscape Portable Runtime (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSPR"
+msys2_references=(
+  "cpe: cpe:/a:mozilla:netscape_portable_runtime"
+)
 license=('spdx:MPL-2.0')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-nss/PKGBUILD b/mingw-w64-nss/PKGBUILD
index 8a422ec092..27543a6a7c 100644
--- a/mingw-w64-nss/PKGBUILD
+++ b/mingw-w64-nss/PKGBUILD
@@ -11,6 +11,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: nss'
+  "cpe: cpe:/a:mozilla:network_security_services"
+  "cpe: cpe:/a:mozilla:nss"
+  "cpe: cpe:/a:mozilla:nss_esr"
 )
 msys2_repository_url='https://hg.mozilla.org/projects/nss/'
 msys2_changelog_url='https://firefox-source-docs.mozilla.org/security/nss/releases/index.html'
diff --git a/mingw-w64-ocaml/PKGBUILD b/mingw-w64-ocaml/PKGBUILD
index 05cef7a753..b51ef2434a 100644
--- a/mingw-w64-ocaml/PKGBUILD
+++ b/mingw-w64-ocaml/PKGBUILD
@@ -17,6 +17,7 @@ url='https://ocaml.org/'
 msys2_repository_url="https://github.com/ocaml/ocaml"
 msys2_references=(
   'archlinux: ocaml'
+  "cpe: cpe:/a:ocaml:ocaml"
 )
 license=('spdx:LGPL-2.1-or-later WITH OCaml-LGPL-linking-exception')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-okular/PKGBUILD b/mingw-w64-okular/PKGBUILD
index 9064f7d773..00e7f124d4 100644
--- a/mingw-w64-okular/PKGBUILD
+++ b/mingw-w64-okular/PKGBUILD
@@ -11,6 +11,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: okular'
+  "cpe: cpe:/a:kde:okular"
 )
 msys2_repository_url="https://invent.kde.org/graphics/okular/"
 url="https://apps.kde.org/okular/"
diff --git a/mingw-w64-oniguruma/PKGBUILD b/mingw-w64-oniguruma/PKGBUILD
index fac9499039..e5dfd945fc 100644
--- a/mingw-w64-oniguruma/PKGBUILD
+++ b/mingw-w64-oniguruma/PKGBUILD
@@ -11,6 +11,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('BSD')
 url="https://github.com/kkos/oniguruma"
+msys2_references=(
+  "cpe: cpe:/a:oniguruma_project:oniguruma"
+)
 options=('staticlibs')
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools" "${MINGW_PACKAGE_PREFIX}-cc")
 source=("https://github.com/kkos/${_fullname}/releases/download/v${pkgver}/${_realname}-${pkgver}.tar.gz"
diff --git a/mingw-w64-open62541/PKGBUILD b/mingw-w64-open62541/PKGBUILD
index 6899c22173..a0af15f7d1 100644
--- a/mingw-w64-open62541/PKGBUILD
+++ b/mingw-w64-open62541/PKGBUILD
@@ -7,6 +7,9 @@ _commit="0bb2b0142c4a9a89eae8a6a7a1ea95801ab3582d"
 pkgdesc="An open source and free implementation of OPC Unified Architecture written in the common subset of the C99 and C++98 languages."
 arch=('any')
 url="http://open62541.org/"
+msys2_references=(
+  "cpe: cpe:/a:open62541:open62541"
+)
 license=('spdx:MPL-2.0')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
diff --git a/mingw-w64-openblas/PKGBUILD b/mingw-w64-openblas/PKGBUILD
index d248e4b506..85deccac2c 100644
--- a/mingw-w64-openblas/PKGBUILD
+++ b/mingw-w64-openblas/PKGBUILD
@@ -14,6 +14,7 @@ url="https://www.openblas.net/"
 msys2_repository_url="https://github.com/OpenMathLib/OpenBLAS"
 msys2_references=(
   'archlinux: openblas'
+  "cpe: cpe:/a:openblas_project:openblas"
 )
 license=('spdx:BSD-3-Clause')
 provides=("${MINGW_PACKAGE_PREFIX}-${_realname}")
diff --git a/mingw-w64-opencv/PKGBUILD b/mingw-w64-opencv/PKGBUILD
index da5a004603..cf3427eb8a 100644
--- a/mingw-w64-opencv/PKGBUILD
+++ b/mingw-w64-opencv/PKGBUILD
@@ -15,6 +15,7 @@ url="https://opencv.org/"
 msys2_repository_url="https://github.com/opencv/opencv"
 msys2_references=(
   'archlinux: opencv'
+  "cpe: cpe:/a:opencv:opencv"
 )
 license=("spdx:Apache-2.0")
 depends=($([[ "$_enable_gst" == "yes" ]] && echo "${MINGW_PACKAGE_PREFIX}-gst-plugins-base")
diff --git a/mingw-w64-openexr/PKGBUILD b/mingw-w64-openexr/PKGBUILD
index 2a96cf4412..19628e1312 100644
--- a/mingw-w64-openexr/PKGBUILD
+++ b/mingw-w64-openexr/PKGBUILD
@@ -10,6 +10,10 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.openexr.com/"
 msys2_repository_url='https://github.com/AcademySoftwareFoundation/openexr'
+msys2_references=(
+  "cpe: cpe:/a:ilm:openexr"
+  "cpe: cpe:/a:openexr:openexr"
+)
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-imath"
          "${MINGW_PACKAGE_PREFIX}-libdeflate"
diff --git a/mingw-w64-openh264/PKGBUILD b/mingw-w64-openh264/PKGBUILD
index 2bb184c204..8668e21ab4 100644
--- a/mingw-w64-openh264/PKGBUILD
+++ b/mingw-w64-openh264/PKGBUILD
@@ -11,6 +11,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.openh264.org/"
 msys2_repository_url="https://github.com/cisco/openh264"
+msys2_references=(
+  "cpe: cpe:/a:cisco:openh264"
+)
 license=('spdx:BSD-2-Clause')
 makedepends=(
   "${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-openimageio/PKGBUILD b/mingw-w64-openimageio/PKGBUILD
index 659b16787b..6916e10732 100644
--- a/mingw-w64-openimageio/PKGBUILD
+++ b/mingw-w64-openimageio/PKGBUILD
@@ -13,6 +13,7 @@ msys2_repository_url="https://github.com/AcademySoftwareFoundation/OpenImageIO"
 msys2_references=(
   'archlinux: openimageio'
   'gentoo: media-libs/openimageio'
+  "cpe: cpe:/a:openimageio:openimageio"
 )
 license=('spdx:Apache-2.0')
 depends=("${MINGW_PACKAGE_PREFIX}-boost"
diff --git a/mingw-w64-openjpeg2/PKGBUILD b/mingw-w64-openjpeg2/PKGBUILD
index 520b9ebfda..846553c9ba 100644
--- a/mingw-w64-openjpeg2/PKGBUILD
+++ b/mingw-w64-openjpeg2/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="An open source JPEG 2000 codec (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_repository_url='https://github.com/uclouvain/openjpeg'
+msys2_references=(
+  "cpe: cpe:/a:uclouvain:openjpeg"
+)
 url="https://www.openjpeg.org/"
 license=("spdx:BSD-2-Clause")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-openldap/PKGBUILD b/mingw-w64-openldap/PKGBUILD
index 3fb46a7f33..88ef049aa6 100644
--- a/mingw-w64-openldap/PKGBUILD
+++ b/mingw-w64-openldap/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.openldap.org/"
 msys2_repository_url="https://git.openldap.org/openldap/openldap"
+msys2_references=(
+  "cpe: cpe:/a:openldap:openldap"
+)
 license=("The OpenLDAP Public License")
 depends=("${MINGW_PACKAGE_PREFIX}-cyrus-sasl"
          "${MINGW_PACKAGE_PREFIX}-libltdl"
diff --git a/mingw-w64-openmp/PKGBUILD b/mingw-w64-openmp/PKGBUILD
index 565cc75fa4..07eee62a75 100644
--- a/mingw-w64-openmp/PKGBUILD
+++ b/mingw-w64-openmp/PKGBUILD
@@ -14,6 +14,9 @@ pkgver=${_version}${_rc/-/}
 pkgrel=1
 pkgdesc="LLVM OpenMP Library (mingw-w64)"
 url="https://openmp.llvm.org/"
+msys2_references=(
+  "cpe: cpe:/a:llvm:llvm"
+)
 license=("spdx:Apache-2.0 WITH LLVM-exception")
 arch=(any)
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
diff --git a/mingw-w64-openssl/PKGBUILD b/mingw-w64-openssl/PKGBUILD
index 97896da2c8..262016445b 100644
--- a/mingw-w64-openssl/PKGBUILD
+++ b/mingw-w64-openssl/PKGBUILD
@@ -12,6 +12,7 @@ url='https://www.openssl.org/'
 msys2_repository_url="https://github.com/openssl/openssl"
 msys2_references=(
   'archlinux: openssl'
+  "cpe: cpe:/a:openssl:openssl"
 )
 license=("spdx:Apache-2.0")
 optdepends=("${MINGW_PACKAGE_PREFIX}-ca-certificates")
diff --git a/mingw-w64-optipng/PKGBUILD b/mingw-w64-optipng/PKGBUILD
index 557e4137a2..a84af633ba 100644
--- a/mingw-w64-optipng/PKGBUILD
+++ b/mingw-w64-optipng/PKGBUILD
@@ -10,6 +10,10 @@ pkgdesc="Compresses PNG files to a smaller size, without losing any information
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://optipng.sourceforge.io/"
+msys2_references=(
+  "cpe: cpe:/a:optipng:optipng"
+  "cpe: cpe:/a:optipng_project:optipng"
+)
 license=('spdx:Zlib')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-opusfile/PKGBUILD b/mingw-w64-opusfile/PKGBUILD
index 2425bb004e..fb87413dbe 100644
--- a/mingw-w64-opusfile/PKGBUILD
+++ b/mingw-w64-opusfile/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Library for opening, seeking, and decoding .opus files (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.opus-codec.org/"
+msys2_references=(
+  "cpe: cpe:/a:xiph:opusfile"
+)
 license=("BSD")
 depends=("${MINGW_PACKAGE_PREFIX}-libogg"
          "${MINGW_PACKAGE_PREFIX}-openssl"
diff --git a/mingw-w64-p11-kit/PKGBUILD b/mingw-w64-p11-kit/PKGBUILD
index b3ff45126f..1a4d46a419 100644
--- a/mingw-w64-p11-kit/PKGBUILD
+++ b/mingw-w64-p11-kit/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="Library to work with PKCS#11 modules (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://p11-glue.freedesktop.org/p11-kit.html"
+msys2_references=(
+  "cpe: cpe:/a:p11-kit_project:p11-kit"
+)
 license=('BSD')
 depends=("${MINGW_PACKAGE_PREFIX}-libtasn1"
          "${MINGW_PACKAGE_PREFIX}-libffi"
diff --git a/mingw-w64-pango/PKGBUILD b/mingw-w64-pango/PKGBUILD
index c8fe045694..c8f9f29ad1 100644
--- a/mingw-w64-pango/PKGBUILD
+++ b/mingw-w64-pango/PKGBUILD
@@ -11,6 +11,10 @@ pkgdesc="A library for layout and rendering of text (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.pango.org/"
+msys2_references=(
+  "cpe: cpe:/a:gnome:pango"
+  "cpe: cpe:/a:pango:pango"
+)
 license=('spdx:LGPL-2.1')
 makedepends=("${MINGW_PACKAGE_PREFIX}-pkgconf"
              "${MINGW_PACKAGE_PREFIX}-gobject-introspection"
diff --git a/mingw-w64-pcre/PKGBUILD b/mingw-w64-pcre/PKGBUILD
index 8e3132f658..2a3d5b3f24 100644
--- a/mingw-w64-pcre/PKGBUILD
+++ b/mingw-w64-pcre/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="A library that implements Perl 5-style regular expressions (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://pcre.org/"
+msys2_references=(
+  "cpe: cpe:/a:pcre:pcre"
+  "cpe: cpe:/a:perl:pcre"
+)
 license=("BSD")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-pcre2/PKGBUILD b/mingw-w64-pcre2/PKGBUILD
index d43faeee9b..552dca0a67 100644
--- a/mingw-w64-pcre2/PKGBUILD
+++ b/mingw-w64-pcre2/PKGBUILD
@@ -10,6 +10,10 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://pcre.org/"
 msys2_repository_url="https://github.com/PhilipHazel/pcre2"
+msys2_references=(
+  "cpe: cpe:/a:pcre:pcre"
+  "cpe: cpe:/a:pcre:pcre2"
+)
 license=("spdx:BSD-3-Clause")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 depends=("${MINGW_PACKAGE_PREFIX}-bzip2"
diff --git a/mingw-w64-perl/PKGBUILD b/mingw-w64-perl/PKGBUILD
index 5ca266f339..6c63ccdf03 100644
--- a/mingw-w64-perl/PKGBUILD
+++ b/mingw-w64-perl/PKGBUILD
@@ -21,7 +21,9 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.perl.org"
 msys2_repository_url="https://github.com/Perl/perl5"
 msys2_references=(
-    'archlinux: perl'
+  'archlinux: perl'
+  "cpe: cpe:/a:larry_wall:perl"
+  "cpe: cpe:/a:perl:perl"
 )
 license=('spdx:Artistic-1.0-Perl OR GPL-1.0-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-gcc"
diff --git a/mingw-w64-pidgin/PKGBUILD b/mingw-w64-pidgin/PKGBUILD
index 6713ea09fb..b0527341c3 100644
--- a/mingw-w64-pidgin/PKGBUILD
+++ b/mingw-w64-pidgin/PKGBUILD
@@ -11,7 +11,8 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64')
 url='https://pidgin.im'
 msys2_references=(
-  'cpe: cpe:/a:pidgin:pidgin'
+  "cpe: cpe:/a:pidgin:libpurple"
+  "cpe: cpe:/a:pidgin:pidgin"
 )
 license=(spdx:GPL-2.0-or-later AND GPL-2.0-only) # GPL2+, but Novell and SILC are GPL2-only
 provides=("${MINGW_PACKAGE_PREFIX}-libpurple")
diff --git a/mingw-w64-pkgconf/PKGBUILD b/mingw-w64-pkgconf/PKGBUILD
index f62da53fef..64502c4f23 100644
--- a/mingw-w64-pkgconf/PKGBUILD
+++ b/mingw-w64-pkgconf/PKGBUILD
@@ -8,6 +8,9 @@ pkgver=2.1.1
 pkgrel=1
 pkgdesc='pkg-config compatible utility which does not depend on glib'
 url='https://github.com/pkgconf/pkgconf'
+msys2_references=(
+  "cpe: cpe:/a:pkgconf:pkgconf"
+)
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('spdx:ISC')
diff --git a/mingw-w64-pngcrush/PKGBUILD b/mingw-w64-pngcrush/PKGBUILD
index ea226a9c21..652d824091 100644
--- a/mingw-w64-pngcrush/PKGBUILD
+++ b/mingw-w64-pngcrush/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A tool for optimizing the compression of PNG files (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://pmt.sourceforge.io/pngcrush"
+msys2_references=(
+  "cpe: cpe:/a:pngcrush_project:pngcrush"
+)
 license=('custom')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs" "${MINGW_PACKAGE_PREFIX}-libpng" "${MINGW_PACKAGE_PREFIX}-zlib")
diff --git a/mingw-w64-pngquant/PKGBUILD b/mingw-w64-pngquant/PKGBUILD
index 5ed2c9b6b3..6830e339d8 100644
--- a/mingw-w64-pngquant/PKGBUILD
+++ b/mingw-w64-pngquant/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Command-line utility to quantize PNGs down to 8-bit paletted PNGs (ming
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://pngquant.org/'
+msys2_references=(
+  "cpe: cpe:/a:pngquant:pngquant"
+)
 license=("spdx:GPL-3.0-or-later")
 depends=("${MINGW_PACKAGE_PREFIX}-libpng"
          "${MINGW_PACKAGE_PREFIX}-lcms2"
diff --git a/mingw-w64-podman/PKGBUILD b/mingw-w64-podman/PKGBUILD
index 1499f8a25d..b84bf73edb 100644
--- a/mingw-w64-podman/PKGBUILD
+++ b/mingw-w64-podman/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='Tool for running OCI-based containers in pods (mingw-w64)'
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://github.com/containers/podman"
+msys2_references=(
+  "cpe: cpe:/a:podman_project:podman"
+)
 license=('spdx:Apache-2.0')
 makedepends=(
     "${MINGW_PACKAGE_PREFIX}-go"
diff --git a/mingw-w64-podofo/PKGBUILD b/mingw-w64-podofo/PKGBUILD
index 3f2122b476..22ffc50f0f 100644
--- a/mingw-w64-podofo/PKGBUILD
+++ b/mingw-w64-podofo/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://podofo.sourceforge.io/"
 msys2_repository_url="https://github.com/podofo/podofo"
+msys2_references=(
+  "cpe: cpe:/a:podofo_project:podofo"
+)
 license=('spdx:LGPL-2.0-or-later AND GPL-2.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-fontconfig"
          "${MINGW_PACKAGE_PREFIX}-libtiff"
diff --git a/mingw-w64-polipo/PKGBUILD b/mingw-w64-polipo/PKGBUILD
index 952a9aee45..775817db72 100644
--- a/mingw-w64-polipo/PKGBUILD
+++ b/mingw-w64-polipo/PKGBUILD
@@ -11,6 +11,11 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 license=('MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc")
 url="https://github.com/jech/${_realname}"
+msys2_references=(
+  "cpe: cpe:/a:polipo:polipo"
+  "cpe: cpe:/a:polipo_project:polipo"
+  "cpe: cpe:/a:pps.jussieu:polipo"
+)
 source=("${url}/archive/${_realname}-${pkgver}.tar.gz"
         '416e59f75934cd1c42fcf043f118b2d1a4e4e8d4.patch'
         'a532fc1ceee6cb6ecb5dd04cb360a757bb037dfe.patch'
diff --git a/mingw-w64-poppler/PKGBUILD b/mingw-w64-poppler/PKGBUILD
index ec637cfe9b..3bf5d83e58 100644
--- a/mingw-w64-poppler/PKGBUILD
+++ b/mingw-w64-poppler/PKGBUILD
@@ -12,6 +12,10 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://poppler.freedesktop.org/"
 msys2_repository_url="https://gitlab.freedesktop.org/poppler/poppler"
+msys2_references=(
+  "cpe: cpe:/a:freedesktop:poppler"
+  "cpe: cpe:/a:poppler:poppler"
+)
 license=('spdx:GPL-2.0-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-postgis/PKGBUILD b/mingw-w64-postgis/PKGBUILD
index 863a1d7108..27d869aae6 100644
--- a/mingw-w64-postgis/PKGBUILD
+++ b/mingw-w64-postgis/PKGBUILD
@@ -12,6 +12,7 @@ url="https://postgis.net/"
 msys2_repository_url="https://git.osgeo.org/gitea/postgis/postgis"
 msys2_references=(
   'archlinux: postgis'
+  "cpe: cpe:/a:postgis:postgis"
 )
 license=('spdx:GPL-2.0-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
diff --git a/mingw-w64-potrace/PKGBUILD b/mingw-w64-potrace/PKGBUILD
index b8749ea19e..a89ba88bd6 100644
--- a/mingw-w64-potrace/PKGBUILD
+++ b/mingw-w64-potrace/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Tool for tracing a bitmap, which means, transforming a bitmap into a sm
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://potrace.sourceforge.io/'
+msys2_references=(
+  "cpe: cpe:/a:potrace_project:potrace"
+)
 license=('GPL2')
 depends=("${MINGW_PACKAGE_PREFIX}-zlib")
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools" "${MINGW_PACKAGE_PREFIX}-cc")
diff --git a/mingw-w64-protobuf-c/PKGBUILD b/mingw-w64-protobuf-c/PKGBUILD
index fe9b9ca2d6..7b4b1ff173 100644
--- a/mingw-w64-protobuf-c/PKGBUILD
+++ b/mingw-w64-protobuf-c/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Protocol Buffers implementation in C (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://github.com/protobuf-c/protobuf-c"
+msys2_references=(
+  "cpe: cpe:/a:protobuf-c_project:protobuf-c"
+)
 license=('spdx:BSD-2-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-abseil-cpp"
          "${MINGW_PACKAGE_PREFIX}-protobuf")
diff --git a/mingw-w64-protobuf/PKGBUILD b/mingw-w64-protobuf/PKGBUILD
index 4c810c841c..5e9b33db1d 100644
--- a/mingw-w64-protobuf/PKGBUILD
+++ b/mingw-w64-protobuf/PKGBUILD
@@ -13,6 +13,8 @@ url='https://developers.google.com/protocol-buffers/'
 msys2_repository_url="https://github.com/protocolbuffers/protobuf"
 msys2_references=(
   'archlinux: protobuf'
+  "cpe: cpe:/a:google:google-protobuf"
+  "cpe: cpe:/a:google:protobuf"
 )
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-ptex/PKGBUILD b/mingw-w64-ptex/PKGBUILD
index 8601722bed..1703297d0b 100644
--- a/mingw-w64-ptex/PKGBUILD
+++ b/mingw-w64-ptex/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Per-Face Texture Mapping for Production Rendering (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://ptex.us/'
+msys2_references=(
+  "cpe: cpe:/a:disneyanimation:ptex"
+)
 license=('spdx:BSD-3-Clause')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-pulseaudio/PKGBUILD b/mingw-w64-pulseaudio/PKGBUILD
index 21e9830072..b01da43564 100644
--- a/mingw-w64-pulseaudio/PKGBUILD
+++ b/mingw-w64-pulseaudio/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A featureful, general-purpose sound server (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://www.freedesktop.org/wiki/Software/PulseAudio/"
+msys2_references=(
+  "cpe: cpe:/a:pulseaudio:pulseaudio"
+)
 license=('spdx:GPL-2.0-or-later' 'spdx:LGPL-2.1-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-fftw"
          "${MINGW_PACKAGE_PREFIX}-gdbm"
diff --git a/mingw-w64-pupnp/PKGBUILD b/mingw-w64-pupnp/PKGBUILD
index e3a6aee4fb..47c3af57a9 100644
--- a/mingw-w64-pupnp/PKGBUILD
+++ b/mingw-w64-pupnp/PKGBUILD
@@ -11,6 +11,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: libupnp'
+  "cpe: cpe:/a:libupnp_project:libupnp"
 )
 url="https://github.com/pupnp/pupnp"
 license=('spdx:BSD-3-Clause')
diff --git a/mingw-w64-putty/PKGBUILD b/mingw-w64-putty/PKGBUILD
index 9f6e749f36..828b8aa1a6 100644
--- a/mingw-w64-putty/PKGBUILD
+++ b/mingw-w64-putty/PKGBUILD
@@ -12,6 +12,10 @@ pkgdesc="A free telnet/SSH client (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.chiark.greenend.org.uk/~sgtatham/putty/"
+msys2_references=(
+  "cpe: cpe:/a:putty:putty"
+  "cpe: cpe:/a:simon_tatham:putty"
+)
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-python-asyncpg/PKGBUILD b/mingw-w64-python-asyncpg/PKGBUILD
index 04ca5f3c7c..340aa80554 100644
--- a/mingw-w64-python-asyncpg/PKGBUILD
+++ b/mingw-w64-python-asyncpg/PKGBUILD
@@ -11,6 +11,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://github.com/MagicStack/asyncpg'
 msys2_references=(
   'pypi: asyncpg'
+  "cpe: cpe:/a:magic:asyncpg"
 )
 license=('spdx:Apache-2.0')
 depends=("${MINGW_PACKAGE_PREFIX}-python"
diff --git a/mingw-w64-python-babel/PKGBUILD b/mingw-w64-python-babel/PKGBUILD
index 549a7b549d..5f1432fb1c 100644
--- a/mingw-w64-python-babel/PKGBUILD
+++ b/mingw-w64-python-babel/PKGBUILD
@@ -14,6 +14,7 @@ url="https://babel.pocoo.org/"
 msys2_repository_url='https://github.com/python-babel/babel'
 msys2_references=(
   'pypi: Babel'
+  "cpe: cpe:/a:pocoo:babel"
 )
 license=('spdx:BSD-3-Clause')
 arch=('any')
diff --git a/mingw-w64-python-beaker/PKGBUILD b/mingw-w64-python-beaker/PKGBUILD
index c8760e0ee8..85f2a447b1 100644
--- a/mingw-w64-python-beaker/PKGBUILD
+++ b/mingw-w64-python-beaker/PKGBUILD
@@ -14,6 +14,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('custom')
 url="https://beaker.readthedocs.org/"
+msys2_references=(
+  "cpe: cpe:/a:python:beaker"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-python")
 makedepends=("${MINGW_PACKAGE_PREFIX}-python-setuptools")
 source=(${_realname}-${pkgver}.tar.gz::https://github.com/bbangert/beaker/archive/${pkgver}.tar.gz)
diff --git a/mingw-w64-python-bleach/PKGBUILD b/mingw-w64-python-bleach/PKGBUILD
index 0dc34b3802..79ee35f0ef 100644
--- a/mingw-w64-python-bleach/PKGBUILD
+++ b/mingw-w64-python-bleach/PKGBUILD
@@ -15,6 +15,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: bleach'
+  "cpe: cpe:/a:mozilla:bleach"
 )
 license=('spdx:Apache-2.0')
 depends=("${MINGW_PACKAGE_PREFIX}-python"
diff --git a/mingw-w64-python-bottle/PKGBUILD b/mingw-w64-python-bottle/PKGBUILD
index 60a0bfa7e3..d4bc0e7827 100755
--- a/mingw-w64-python-bottle/PKGBUILD
+++ b/mingw-w64-python-bottle/PKGBUILD
@@ -11,6 +11,7 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: python-bottle'
   'pypi: bottle'
+  "cpe: cpe:/a:bottlepy:bottle"
 )
 msys2_repository_url='https://github.com/bottlepy/bottle'
 msys2_changelog_url='https://bottlepy.org/docs/dev/changelog.html'
diff --git a/mingw-w64-python-cookiecutter/PKGBUILD b/mingw-w64-python-cookiecutter/PKGBUILD
index 2fc09b60c6..9d7a2c23c3 100644
--- a/mingw-w64-python-cookiecutter/PKGBUILD
+++ b/mingw-w64-python-cookiecutter/PKGBUILD
@@ -12,6 +12,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: python-cookiecutter'
   'pypi: cookiecutter'
+  "cpe: cpe:/a:cookiecutter_project:cookiecutter"
 )
 msys2_documentation_url='https://cookiecutter.readthedocs.io/'
 url="https://github.com/cookiecutter/cookiecutter"
diff --git a/mingw-w64-python-cryptography/PKGBUILD b/mingw-w64-python-cryptography/PKGBUILD
index 0f7c5867c1..abfc1323ae 100644
--- a/mingw-w64-python-cryptography/PKGBUILD
+++ b/mingw-w64-python-cryptography/PKGBUILD
@@ -17,6 +17,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: cryptography'
+  "cpe: cpe:/a:cryptography:python-cryptography"
+  "cpe: cpe:/a:cryptography_project:cryptography"
+  "cpe: cpe:/a:python-cryptography_project:python-cryptography"
 )
 depends=("${MINGW_PACKAGE_PREFIX}-python"
          "${MINGW_PACKAGE_PREFIX}-python-cffi"
diff --git a/mingw-w64-python-cvxopt/PKGBUILD b/mingw-w64-python-cvxopt/PKGBUILD
index a6e535d71e..7c07dde8ab 100644
--- a/mingw-w64-python-cvxopt/PKGBUILD
+++ b/mingw-w64-python-cvxopt/PKGBUILD
@@ -13,6 +13,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'pypi: cvxopt'
+  "cpe: cpe:/a:cvxopt_project:cvxopt"
 )
 url='https://cvxopt.org/'
 license=('spdx:GPL-3.0-or-later')
diff --git a/mingw-w64-python-django/PKGBUILD b/mingw-w64-python-django/PKGBUILD
index 0881fe0ffe..d672b700f8 100644
--- a/mingw-w64-python-django/PKGBUILD
+++ b/mingw-w64-python-django/PKGBUILD
@@ -14,6 +14,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: python-django'
   'pypi: Django'
+  "cpe: cpe:/a:djangoproject:django"
 )
 msys2_repository_url='https://github.com/django/django/'
 url='https://www.djangoproject.com/'
diff --git a/mingw-w64-python-ecdsa/PKGBUILD b/mingw-w64-python-ecdsa/PKGBUILD
index edce2e6146..20f8e19adc 100644
--- a/mingw-w64-python-ecdsa/PKGBUILD
+++ b/mingw-w64-python-ecdsa/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: ecdsa'
+  "cpe: cpe:/a:python-ecdsa_project:python-ecdsa"
 )
 url="https://github.com/tlsfuzzer/python-ecdsa"
 license=('MIT')
diff --git a/mingw-w64-python-flask-cors/PKGBUILD b/mingw-w64-python-flask-cors/PKGBUILD
index 15e4f2cc48..7a2da5e7e8 100644
--- a/mingw-w64-python-flask-cors/PKGBUILD
+++ b/mingw-w64-python-flask-cors/PKGBUILD
@@ -12,6 +12,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://github.com/corydolphin/flask-cors"
 msys2_references=(
   'pypi: Flask-Cors'
+  "cpe: cpe:/a:flask-cors_project:flask-cors"
 )
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-python"
diff --git a/mingw-w64-python-flask/PKGBUILD b/mingw-w64-python-flask/PKGBUILD
index 7b0e843020..a27f45af29 100644
--- a/mingw-w64-python-flask/PKGBUILD
+++ b/mingw-w64-python-flask/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'pypi: Flask'
+  "cpe: cpe:/a:palletsprojects:flask"
 )
 url="https://flask.palletsprojects.com/"
 license=('spdx:BSD-3-Clause')
diff --git a/mingw-w64-python-future/PKGBUILD b/mingw-w64-python-future/PKGBUILD
index 6011879f29..13836b4904 100644
--- a/mingw-w64-python-future/PKGBUILD
+++ b/mingw-w64-python-future/PKGBUILD
@@ -14,6 +14,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://python-future.org/'
 msys2_references=(
   'pypi: future'
+  "cpe: cpe:/a:pythoncharmers:python-future"
 )
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-python")
diff --git a/mingw-w64-python-hpack/PKGBUILD b/mingw-w64-python-hpack/PKGBUILD
index 66dd5d6e60..b9a983c9fd 100644
--- a/mingw-w64-python-hpack/PKGBUILD
+++ b/mingw-w64-python-hpack/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 license=('MIT')
 url='https://github.com/python-hyper/hpack'
+msys2_references=(
+  "cpe: cpe:/a:python:hpack"
+)
 depends=(${MINGW_PACKAGE_PREFIX}-python)
 makedepends=(${MINGW_PACKAGE_PREFIX}-python-setuptools)
 source=(https://github.com/python-hyper/${_realname}/archive/v${pkgver}.tar.gz)
diff --git a/mingw-w64-python-httplib2/PKGBUILD b/mingw-w64-python-httplib2/PKGBUILD
index f38c075f1b..a5aab59105 100644
--- a/mingw-w64-python-httplib2/PKGBUILD
+++ b/mingw-w64-python-httplib2/PKGBUILD
@@ -14,6 +14,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('MIT')
 url="https://github.com/httplib2/httplib2"
+msys2_references=(
+  "cpe: cpe:/a:httplib2_project:httplib2"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-python"
          "${MINGW_PACKAGE_PREFIX}-python-certifi"
          "${MINGW_PACKAGE_PREFIX}-ca-certificates"
diff --git a/mingw-w64-python-httpx/PKGBUILD b/mingw-w64-python-httpx/PKGBUILD
index fcd155f5a4..c5bd7e3658 100644
--- a/mingw-w64-python-httpx/PKGBUILD
+++ b/mingw-w64-python-httpx/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://www.python-httpx.org/'
 msys2_repository_url='https://github.com/encode/httpx'
+msys2_references=(
+  "cpe: cpe:/a:encode:httpx"
+)
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-python"
          "${MINGW_PACKAGE_PREFIX}-python-certifi"
diff --git a/mingw-w64-python-ipython/PKGBUILD b/mingw-w64-python-ipython/PKGBUILD
index b6c09537c8..3f2e072acc 100644
--- a/mingw-w64-python-ipython/PKGBUILD
+++ b/mingw-w64-python-ipython/PKGBUILD
@@ -14,6 +14,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: ipython'
   'pypi: ipython'
+  "cpe: cpe:/a:ipython:ipython"
 )
 msys2_repository_url='https://github.com/ipython/ipython/'
 msys2_documentation_url='https://ipython.readthedocs.org/'
diff --git a/mingw-w64-python-jinja/PKGBUILD b/mingw-w64-python-jinja/PKGBUILD
index 4fe28f5e86..e059187ddd 100644
--- a/mingw-w64-python-jinja/PKGBUILD
+++ b/mingw-w64-python-jinja/PKGBUILD
@@ -12,6 +12,9 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('spdx:BSD-3-Clause')
 url='https://jinja.palletsprojects.com/'
 msys2_repository_url='https://github.com/pallets/jinja'
+msys2_references=(
+  "cpe: cpe:/a:palletsprojects:jinja"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-python-markupsafe")
 makedepends=("${MINGW_PACKAGE_PREFIX}-python-setuptools")
 provides=("${MINGW_PACKAGE_PREFIX}-python3-${_realname}")
diff --git a/mingw-w64-python-joblib/PKGBUILD b/mingw-w64-python-joblib/PKGBUILD
index 2c916101b9..9390b419c1 100644
--- a/mingw-w64-python-joblib/PKGBUILD
+++ b/mingw-w64-python-joblib/PKGBUILD
@@ -14,6 +14,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: python-joblib'
   'pypi: joblib'
+  "cpe: cpe:/a:joblib_project:joblib"
 )
 msys2_repository_url='https://github.com/joblib/joblib/'
 url='https://joblib.readthedocs.io/'
diff --git a/mingw-w64-python-jupyter_notebook/PKGBUILD b/mingw-w64-python-jupyter_notebook/PKGBUILD
index d88ce41307..ad0198b1b6 100644
--- a/mingw-w64-python-jupyter_notebook/PKGBUILD
+++ b/mingw-w64-python-jupyter_notebook/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: jupyter-notebook'
+  "cpe: cpe:/a:jupyter:notebook"
 )
 url='https://jupyter.org/'
 license=('spdx:BSD-3-Clause')
diff --git a/mingw-w64-python-jupyter_server/PKGBUILD b/mingw-w64-python-jupyter_server/PKGBUILD
index f6ff4ccaa1..1348f8d127 100644
--- a/mingw-w64-python-jupyter_server/PKGBUILD
+++ b/mingw-w64-python-jupyter_server/PKGBUILD
@@ -11,6 +11,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: jupyter-server'
   'pypi: jupyter-server'
+  "cpe: cpe:/a:jupyter:jupyter_server"
 )
 url='https://jupyter-server.readthedocs.io/'
 msys2_repository_url='https://github.com/jupyter-server/jupyter_server/'
diff --git a/mingw-w64-python-keyring/PKGBUILD b/mingw-w64-python-keyring/PKGBUILD
index ff9446b238..366fd83174 100644
--- a/mingw-w64-python-keyring/PKGBUILD
+++ b/mingw-w64-python-keyring/PKGBUILD
@@ -12,6 +12,7 @@ license=('spdx:MIT')
 url='https://github.com/jaraco/keyring'
 msys2_references=(
   'pypi: keyring'
+  "cpe: cpe:/a:python:keyring"
 )
 depends=(
     ${MINGW_PACKAGE_PREFIX}-python
diff --git a/mingw-w64-python-lmdb/PKGBUILD b/mingw-w64-python-lmdb/PKGBUILD
index 310fc7a2bf..49b7566c59 100644
--- a/mingw-w64-python-lmdb/PKGBUILD
+++ b/mingw-w64-python-lmdb/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 msys2_references=(
   'pypi: lmdb'
+  "cpe: cpe:/a:py-lmdb_project:py-lmdb"
 )
 url="https://github.com/jnwatson/py-lmdb"
 license=('OLDAP-2.8')
diff --git a/mingw-w64-python-lxml/PKGBUILD b/mingw-w64-python-lxml/PKGBUILD
index 4bea5f5eb2..bfaa45aee9 100644
--- a/mingw-w64-python-lxml/PKGBUILD
+++ b/mingw-w64-python-lxml/PKGBUILD
@@ -19,6 +19,7 @@ url="https://lxml.de/"
 msys2_repository_url="https://github.com/lxml/lxml"
 msys2_references=(
   'pypi: lxml'
+  "cpe: cpe:/a:lxml:lxml"
 )
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-libxml2"
diff --git a/mingw-w64-python-mako/PKGBUILD b/mingw-w64-python-mako/PKGBUILD
index 7461438614..8661f808b2 100644
--- a/mingw-w64-python-mako/PKGBUILD
+++ b/mingw-w64-python-mako/PKGBUILD
@@ -16,6 +16,7 @@ url="https://www.makotemplates.org/"
 license=('spdx:MIT')
 msys2_references=(
   'pypi: Mako'
+  "cpe: cpe:/a:sqlalchemy:mako"
 )
 msys2_repository_url="https://github.com/sqlalchemy/mako"
 depends=("${MINGW_PACKAGE_PREFIX}-python"
diff --git a/mingw-w64-python-markdown-it-py/PKGBUILD b/mingw-w64-python-markdown-it-py/PKGBUILD
index aefb28c31e..3559625c7c 100644
--- a/mingw-w64-python-markdown-it-py/PKGBUILD
+++ b/mingw-w64-python-markdown-it-py/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='Python port of markdown-it. Markdown parsing, done right! (mingw-w64)'
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://github.com/executablebooks/markdown-it-py'
+msys2_references=(
+  "cpe: cpe:/a:executablebooks:markdown-it-py"
+)
 license=('MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-python-mdurl")
 makedepends=("${MINGW_PACKAGE_PREFIX}-python-build"
diff --git a/mingw-w64-python-numpy/PKGBUILD b/mingw-w64-python-numpy/PKGBUILD
index fc2f9f6f4b..37b5a8b4ed 100644
--- a/mingw-w64-python-numpy/PKGBUILD
+++ b/mingw-w64-python-numpy/PKGBUILD
@@ -15,6 +15,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('spdx:BSD-3-Clause')
 url="https://www.numpy.org/"
+msys2_references=(
+  "cpe: cpe:/a:numpy:numpy"
+)
 makedepends=("${MINGW_PACKAGE_PREFIX}-python-build"
              "${MINGW_PACKAGE_PREFIX}-python-installer"
              "${MINGW_PACKAGE_PREFIX}-python-wheel"
diff --git a/mingw-w64-python-openpyxl/PKGBUILD b/mingw-w64-python-openpyxl/PKGBUILD
index 007233fab3..c26a2f38ca 100644
--- a/mingw-w64-python-openpyxl/PKGBUILD
+++ b/mingw-w64-python-openpyxl/PKGBUILD
@@ -10,6 +10,9 @@ pkgver=3.1.2
 pkgrel=2
 pkgdesc="A python library to read/write Excel 2007 xlsx/xlsm file (mingw-w64)"
 url="https://openpyxl.readthedocs.io/"
+msys2_references=(
+  "cpe: cpe:/a:python:openpyxl"
+)
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 license=('spdx:MIT')
diff --git a/mingw-w64-python-pandas/PKGBUILD b/mingw-w64-python-pandas/PKGBUILD
index 6c97e0caf5..8a109c93ce 100644
--- a/mingw-w64-python-pandas/PKGBUILD
+++ b/mingw-w64-python-pandas/PKGBUILD
@@ -15,6 +15,7 @@ url="https://pandas.pydata.org/"
 msys2_repository_url="https://github.com/pandas-dev/pandas"
 msys2_references=(
   'pypi: pandas'
+  "cpe: cpe:/a:numfocus:pandas"
 )
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-python"
diff --git a/mingw-w64-python-paramiko/PKGBUILD b/mingw-w64-python-paramiko/PKGBUILD
index 55b69e4019..f5fc0e9d00 100644
--- a/mingw-w64-python-paramiko/PKGBUILD
+++ b/mingw-w64-python-paramiko/PKGBUILD
@@ -14,6 +14,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://github.com/paramiko/paramiko/'
 msys2_references=(
   'pypi: paramiko'
+  "cpe: cpe:/a:paramiko:paramiko"
 )
 license=('spdx:LGPL-2.1-or-later')
 depends=(
diff --git a/mingw-w64-python-pillow/PKGBUILD b/mingw-w64-python-pillow/PKGBUILD
index b82d1a645a..616b4c0fc8 100644
--- a/mingw-w64-python-pillow/PKGBUILD
+++ b/mingw-w64-python-pillow/PKGBUILD
@@ -15,6 +15,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: pillow'
+  "cpe: cpe:/a:python:pillow"
 )
 license=('spdx:HPND')
 url="https://github.com/python-pillow/Pillow/"
diff --git a/mingw-w64-python-pip/PKGBUILD b/mingw-w64-python-pip/PKGBUILD
index f9ec20b448..2beb7cb5c9 100644
--- a/mingw-w64-python-pip/PKGBUILD
+++ b/mingw-w64-python-pip/PKGBUILD
@@ -16,6 +16,7 @@ url="https://pip.pypa.io/"
 msys2_repository_url="https://github.com/pypa/pip"
 msys2_references=(
   'pypi: pip'
+  "cpe: cpe:/a:pypa:pip"
 )
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-python"
diff --git a/mingw-w64-python-pipenv/PKGBUILD b/mingw-w64-python-pipenv/PKGBUILD
index d5457f3d1d..112fae3bea 100644
--- a/mingw-w64-python-pipenv/PKGBUILD
+++ b/mingw-w64-python-pipenv/PKGBUILD
@@ -11,6 +11,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'pypi: pipenv'
+  "cpe: cpe:/a:pypa:pipenv"
 )
 license=('spdx:MIT')
 depends=(
diff --git a/mingw-w64-python-poetry/PKGBUILD b/mingw-w64-python-poetry/PKGBUILD
index 4c0bf7eebe..6e42b17c5d 100644
--- a/mingw-w64-python-poetry/PKGBUILD
+++ b/mingw-w64-python-poetry/PKGBUILD
@@ -11,6 +11,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://github.com/python-poetry/poetry"
 msys2_references=(
   'pypi: poetry'
+  "cpe: cpe:/a:python-poetry:poetry"
 )
 license=('spdx:MIT')
 depends=(
diff --git a/mingw-w64-python-protobuf/PKGBUILD b/mingw-w64-python-protobuf/PKGBUILD
index 037d617b79..e7e2e6c895 100644
--- a/mingw-w64-python-protobuf/PKGBUILD
+++ b/mingw-w64-python-protobuf/PKGBUILD
@@ -13,6 +13,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: protobuf'
+  "cpe: cpe:/a:google:protobuf-python"
 )
 url="https://github.com/protocolbuffers/protobuf"
 license=('spdx:BSD-3-Clause')
diff --git a/mingw-w64-python-py/PKGBUILD b/mingw-w64-python-py/PKGBUILD
index f4be2c48ea..9086da972f 100644
--- a/mingw-w64-python-py/PKGBUILD
+++ b/mingw-w64-python-py/PKGBUILD
@@ -12,6 +12,9 @@ pkgdesc='library with cross-python path, ini-parsing, io, code, log facilities (
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://pylib.readthedocs.io/'
+msys2_references=(
+  "cpe: cpe:/a:pytest:py"
+)
 license=('MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-python"
          "${MINGW_PACKAGE_PREFIX}-python-iniconfig"
diff --git a/mingw-w64-python-pydantic/PKGBUILD b/mingw-w64-python-pydantic/PKGBUILD
index 615196406d..dd7561af63 100644
--- a/mingw-w64-python-pydantic/PKGBUILD
+++ b/mingw-w64-python-pydantic/PKGBUILD
@@ -11,6 +11,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://github.com/samuelcolvin/pydantic'
 msys2_references=(
   'pypi: pydantic'
+  "cpe: cpe:/a:pydantic_project:pydantic"
 )
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-python"
diff --git a/mingw-w64-python-pygments/PKGBUILD b/mingw-w64-python-pygments/PKGBUILD
index dc43280046..5e04c2541b 100644
--- a/mingw-w64-python-pygments/PKGBUILD
+++ b/mingw-w64-python-pygments/PKGBUILD
@@ -15,6 +15,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: Pygments'
+  "cpe: cpe:/a:pygments:pygments"
 )
 url="https://pygments.org/"
 msys2_repository_url="https://github.com/pygments/pygments"
diff --git a/mingw-w64-python-pyjwt/PKGBUILD b/mingw-w64-python-pyjwt/PKGBUILD
index c27daa714b..3e4ae2a72a 100644
--- a/mingw-w64-python-pyjwt/PKGBUILD
+++ b/mingw-w64-python-pyjwt/PKGBUILD
@@ -14,6 +14,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: PyJWT'
+  "cpe: cpe:/a:pyjwt_project:pyjwt"
 )
 url='https://github.com/jpadilla/pyjwt'
 license=('spdx:MIT')
diff --git a/mingw-w64-python-pyopenssl/PKGBUILD b/mingw-w64-python-pyopenssl/PKGBUILD
index 3ac88cfedb..3187f20c7a 100644
--- a/mingw-w64-python-pyopenssl/PKGBUILD
+++ b/mingw-w64-python-pyopenssl/PKGBUILD
@@ -16,6 +16,8 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: python-pyopenssl'
   'pypi: pyOpenSSL'
+  "cpe: cpe:/a:pyopenssl:pyopenssl"
+  "cpe: cpe:/a:pyopenssl_project:pyopenssl"
 )
 msys2_repository_url='https://github.com/pyca/pyopenssl/'
 depends=("${MINGW_PACKAGE_PREFIX}-openssl"
diff --git a/mingw-w64-python-rdflib/PKGBUILD b/mingw-w64-python-rdflib/PKGBUILD
index d8b097b87a..7a11dcf8aa 100644
--- a/mingw-w64-python-rdflib/PKGBUILD
+++ b/mingw-w64-python-rdflib/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: rdflib'
+  "cpe: cpe:/a:rdflib_project:rdflib"
 )
 url='https://github.com/RDFLib/rdflib'
 license=('spdx:BSD-3-Clause')
diff --git a/mingw-w64-python-rencode/PKGBUILD b/mingw-w64-python-rencode/PKGBUILD
index 9011d5a5a7..0c0f39257f 100644
--- a/mingw-w64-python-rencode/PKGBUILD
+++ b/mingw-w64-python-rencode/PKGBUILD
@@ -12,6 +12,9 @@ pkgdesc="Python module for fast (basic) object serialization similar to bencode
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url='https://github.com/aresch/rencode'
+msys2_references=(
+  "cpe: cpe:/a:rencode_project:rencode"
+)
 license=('GPLv3')
 validpgpkeys=('gpg_KEY')
 depends=("${MINGW_PACKAGE_PREFIX}-python")
diff --git a/mingw-w64-python-requests/PKGBUILD b/mingw-w64-python-requests/PKGBUILD
index 29418a541a..6fdc22cf52 100644
--- a/mingw-w64-python-requests/PKGBUILD
+++ b/mingw-w64-python-requests/PKGBUILD
@@ -14,6 +14,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: requests'
+  "cpe: cpe:/a:python:requests"
 )
 license=('spdx:Apache-2.0')
 url="https://requests.readthedocs.io"
diff --git a/mingw-w64-python-rope/PKGBUILD b/mingw-w64-python-rope/PKGBUILD
index 4449b03ab7..e0822b3ff6 100644
--- a/mingw-w64-python-rope/PKGBUILD
+++ b/mingw-w64-python-rope/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 license=('spdx:LGPL-3.0-only')
 url='https://github.com/python-rope/rope'
+msys2_references=(
+  "cpe: cpe:/a:rope_project:rope"
+)
 depends=(
     ${MINGW_PACKAGE_PREFIX}-python
     ${MINGW_PACKAGE_PREFIX}-python-pytoolconfig)
diff --git a/mingw-w64-python-rpyc/PKGBUILD b/mingw-w64-python-rpyc/PKGBUILD
index 66790a1bef..26a64aec68 100644
--- a/mingw-w64-python-rpyc/PKGBUILD
+++ b/mingw-w64-python-rpyc/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='Remote Python Call - A transparent and symmetric RPC library for python
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://github.com/tomerfiliba-org/rpyc"
+msys2_references=(
+  "cpe: cpe:/a:rpyc_project:rpyc"
+)
 license=('MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-python-plumbum")
 makedepends=("${MINGW_PACKAGE_PREFIX}-python-build"
diff --git a/mingw-w64-python-rsa/PKGBUILD b/mingw-w64-python-rsa/PKGBUILD
index 21c29be13c..65644620a9 100644
--- a/mingw-w64-python-rsa/PKGBUILD
+++ b/mingw-w64-python-rsa/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: rsa'
+  "cpe: cpe:/a:python-rsa_project:python-rsa"
 )
 url="https://github.com/sybrenstuvel/python-rsa/"
 license=('spdx:Apache-2.0')
diff --git a/mingw-w64-python-scikit-learn/PKGBUILD b/mingw-w64-python-scikit-learn/PKGBUILD
index 8533af76eb..ecd09d4d75 100644
--- a/mingw-w64-python-scikit-learn/PKGBUILD
+++ b/mingw-w64-python-scikit-learn/PKGBUILD
@@ -15,6 +15,7 @@ url='https://scikit-learn.org'
 msys2_repository_url="https://github.com/scikit-learn/scikit-learn"
 msys2_references=(
   'pypi: scikit-learn'
+  "cpe: cpe:/a:scikit-learn:scikit-learn"
 )
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-python"
diff --git a/mingw-w64-python-setuptools/PKGBUILD b/mingw-w64-python-setuptools/PKGBUILD
index 8f0d4db67d..8b1d8b9f54 100644
--- a/mingw-w64-python-setuptools/PKGBUILD
+++ b/mingw-w64-python-setuptools/PKGBUILD
@@ -15,6 +15,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: setuptools'
+  "cpe: cpe:/a:python:setuptools"
 )
 license=('spdx:MIT')
 url="https://github.com/pypa/setuptools"
diff --git a/mingw-w64-python-sqlalchemy/PKGBUILD b/mingw-w64-python-sqlalchemy/PKGBUILD
index c029890a00..0521a1ccb7 100644
--- a/mingw-w64-python-sqlalchemy/PKGBUILD
+++ b/mingw-w64-python-sqlalchemy/PKGBUILD
@@ -16,6 +16,7 @@ url='https://www.sqlalchemy.org/'
 msys2_repository_url="https://github.com/sqlalchemy/sqlalchemy"
 msys2_references=(
   'pypi: SQLAlchemy'
+  "cpe: cpe:/a:sqlalchemy:sqlalchemy"
 )
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-python"
diff --git a/mingw-w64-python-sqlparse/PKGBUILD b/mingw-w64-python-sqlparse/PKGBUILD
index 4978c159a1..95fc1f20a9 100644
--- a/mingw-w64-python-sqlparse/PKGBUILD
+++ b/mingw-w64-python-sqlparse/PKGBUILD
@@ -13,6 +13,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: sqlparse'
+  "cpe: cpe:/a:sqlparse_project:sqlparse"
 )
 url='https://github.com/andialbrecht/sqlparse'
 license=('spdx:BSD-3-Clause')
diff --git a/mingw-w64-python-tornado/PKGBUILD b/mingw-w64-python-tornado/PKGBUILD
index f7b2049b5e..6a45799d14 100644
--- a/mingw-w64-python-tornado/PKGBUILD
+++ b/mingw-w64-python-tornado/PKGBUILD
@@ -13,6 +13,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: tornado'
+  "cpe: cpe:/a:tornadoweb:tornado"
 )
 url='https://www.tornadoweb.org/'
 license=('spdx:Apache-2.0')
diff --git a/mingw-w64-python-twisted/PKGBUILD b/mingw-w64-python-twisted/PKGBUILD
index 6acaee6e79..20b5a1f5c2 100644
--- a/mingw-w64-python-twisted/PKGBUILD
+++ b/mingw-w64-python-twisted/PKGBUILD
@@ -12,6 +12,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: python-twisted'
   'pypi: Twisted'
+  "cpe: cpe:/a:twistedmatrix:twisted"
 )
 msys2_repository_url='https://github.com/twisted/twisted/'
 msys2_changelog_url='https://github.com/twisted/twisted/blob/HEAD/NEWS.rst'
diff --git a/mingw-w64-python-typed_ast/PKGBUILD b/mingw-w64-python-typed_ast/PKGBUILD
index 59b77835b3..4976e65f13 100644
--- a/mingw-w64-python-typed_ast/PKGBUILD
+++ b/mingw-w64-python-typed_ast/PKGBUILD
@@ -13,6 +13,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: python-typed-ast'
+  "cpe: cpe:/a:python:typed_ast"
 )
 url='https://github.com/python/typed_ast'
 license=('spdx:Apache-2.0')
diff --git a/mingw-w64-python-ujson/PKGBUILD b/mingw-w64-python-ujson/PKGBUILD
index 9ef6a3155e..52dc30948a 100644
--- a/mingw-w64-python-ujson/PKGBUILD
+++ b/mingw-w64-python-ujson/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Ultra fast JSON encoder and decoder for Python (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/ultrajson/ultrajson"
+msys2_references=(
+  "cpe: cpe:/a:ultrajson_project:ultrajson"
+)
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-python")
 makedepends=("${MINGW_PACKAGE_PREFIX}-python-build"
diff --git a/mingw-w64-python-urllib3/PKGBUILD b/mingw-w64-python-urllib3/PKGBUILD
index 5cc6bea703..01f6311397 100644
--- a/mingw-w64-python-urllib3/PKGBUILD
+++ b/mingw-w64-python-urllib3/PKGBUILD
@@ -14,6 +14,7 @@ license=('MIT')
 arch=('any')
 msys2_references=(
   'pypi: urllib3'
+  "cpe: cpe:/a:python:urllib3"
 )
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 depends=("${MINGW_PACKAGE_PREFIX}-python"
diff --git a/mingw-w64-python-virtualenv/PKGBUILD b/mingw-w64-python-virtualenv/PKGBUILD
index 06a06c4212..896650aa5a 100644
--- a/mingw-w64-python-virtualenv/PKGBUILD
+++ b/mingw-w64-python-virtualenv/PKGBUILD
@@ -11,6 +11,7 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: python-virtualenv'
   'pypi: virtualenv'
+  "cpe: cpe:/a:python:virtualenv"
 )
 msys2_repository_url='https://github.com/pypa/virtualenv/'
 url="https://virtualenv.pypa.io/"
diff --git a/mingw-w64-python-websockets/PKGBUILD b/mingw-w64-python-websockets/PKGBUILD
index a269c84b64..8728544012 100644
--- a/mingw-w64-python-websockets/PKGBUILD
+++ b/mingw-w64-python-websockets/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='Library for building WebSocket servers and clients in Python (mingw-w64
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://github.com/python-websockets/websockets'
+msys2_references=(
+  "cpe: cpe:/a:websockets_project:websockets"
+)
 license=('BSD')
 depends=("${MINGW_PACKAGE_PREFIX}-python")
 makedepends=("${MINGW_PACKAGE_PREFIX}-python-build"
diff --git a/mingw-w64-python-werkzeug/PKGBUILD b/mingw-w64-python-werkzeug/PKGBUILD
index 1a4c481de8..550196d38b 100644
--- a/mingw-w64-python-werkzeug/PKGBUILD
+++ b/mingw-w64-python-werkzeug/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: Werkzeug'
+  "cpe: cpe:/a:palletsprojects:werkzeug"
 )
 url="https://werkzeug.palletsprojects.com/"
 license=('spdx:BSD-3-Clause')
diff --git a/mingw-w64-python-wheel/PKGBUILD b/mingw-w64-python-wheel/PKGBUILD
index 8c80dfffe8..6a554c80b0 100644
--- a/mingw-w64-python-wheel/PKGBUILD
+++ b/mingw-w64-python-wheel/PKGBUILD
@@ -13,6 +13,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: wheel'
+  "cpe: cpe:/a:wheel_project:wheel"
 )
 url="https://github.com/pypa/wheel"
 license=('spdx:MIT')
diff --git a/mingw-w64-python-xdg/PKGBUILD b/mingw-w64-python-xdg/PKGBUILD
index f012fed83b..e0ef677340 100644
--- a/mingw-w64-python-xdg/PKGBUILD
+++ b/mingw-w64-python-xdg/PKGBUILD
@@ -16,6 +16,9 @@ pkgdesc="Python library to access freedesktop.org standards (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url='https://freedesktop.org/Software/pyxdg'
+msys2_references=(
+  "cpe: cpe:/a:python:pyxdg"
+)
 license=('LGPL')
 depends=("${MINGW_PACKAGE_PREFIX}-python")
 makedepends=("${MINGW_PACKAGE_PREFIX}-python-setuptools")
diff --git a/mingw-w64-python-yaml/PKGBUILD b/mingw-w64-python-yaml/PKGBUILD
index c317dc6f21..94b853dcb6 100644
--- a/mingw-w64-python-yaml/PKGBUILD
+++ b/mingw-w64-python-yaml/PKGBUILD
@@ -17,6 +17,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'pypi: PyYAML'
+  "cpe: cpe:/a:pyyaml:pyyaml"
 )
 url='https://pyyaml.org/'
 msys2_repository_url="https://github.com/yaml/pyyaml/"
diff --git a/mingw-w64-python/PKGBUILD b/mingw-w64-python/PKGBUILD
index cc95adcdea..3f8387f5c2 100644
--- a/mingw-w64-python/PKGBUILD
+++ b/mingw-w64-python/PKGBUILD
@@ -29,7 +29,8 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('spdx:PSF-2.0')
 url="https://www.python.org/"
 msys2_references=(
-  'cpe: cpe:/a:python:python'
+  "cpe: cpe:/a:python:python"
+  "cpe: cpe:/a:python_software_foundation:python"
 )
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-expat"
diff --git a/mingw-w64-python2-pip/PKGBUILD b/mingw-w64-python2-pip/PKGBUILD
index 8459b0b57d..3fdc3332ed 100644
--- a/mingw-w64-python2-pip/PKGBUILD
+++ b/mingw-w64-python2-pip/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="An easy_install replacement for installing pypi python packages (mingw-
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64')
 url="https://pip.pypa.io/"
+msys2_references=(
+  "cpe: cpe:/a:pypa:pip"
+)
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-python2"
          "${MINGW_PACKAGE_PREFIX}-python2-setuptools")
diff --git a/mingw-w64-python2-setuptools/PKGBUILD b/mingw-w64-python2-setuptools/PKGBUILD
index 6fd1f3091a..f370cc5d5f 100644
--- a/mingw-w64-python2-setuptools/PKGBUILD
+++ b/mingw-w64-python2-setuptools/PKGBUILD
@@ -11,6 +11,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64')
 license=('PSF')
 url="https://pypi.python.org/pypi/setuptools"
+msys2_references=(
+  "cpe: cpe:/a:python:setuptools"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-python2")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc")
 install=${_realname}2-${MSYSTEM}.install
diff --git a/mingw-w64-python2/PKGBUILD b/mingw-w64-python2/PKGBUILD
index e4f1fa5de1..91e958a291 100644
--- a/mingw-w64-python2/PKGBUILD
+++ b/mingw-w64-python2/PKGBUILD
@@ -13,6 +13,10 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64')
 license=('spdx:PSF-2.0')
 url="https://www.python.org/"
+msys2_references=(
+  "cpe: cpe:/a:python:python"
+  "cpe: cpe:/a:python_software_foundation:python"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-expat"
          "${MINGW_PACKAGE_PREFIX}-bzip2"
diff --git a/mingw-w64-qbittorrent/PKGBUILD b/mingw-w64-qbittorrent/PKGBUILD
index 93913dd692..757f461f89 100644
--- a/mingw-w64-qbittorrent/PKGBUILD
+++ b/mingw-w64-qbittorrent/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://qbittorrent.org/"
 msys2_repository_url="https://github.com/qbittorrent/qBittorrent"
+msys2_references=(
+  "cpe: cpe:/a:qbittorrent:qbittorrent"
+)
 license=('spdx:GPL-2.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-boost"
          "${MINGW_PACKAGE_PREFIX}-openssl"
diff --git a/mingw-w64-qpdf/PKGBUILD b/mingw-w64-qpdf/PKGBUILD
index f681525a4b..7521ed9374 100644
--- a/mingw-w64-qpdf/PKGBUILD
+++ b/mingw-w64-qpdf/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="QPDF: A Content-Preserving PDF Transformation System (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://github.com/qpdf/qpdf"
+msys2_references=(
+  "cpe: cpe:/a:qpdf_project:qpdf"
+)
 license=('spdx:Apache-2.0')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-qt5-3d/PKGBUILD b/mingw-w64-qt5-3d/PKGBUILD
index 5448483843..57b0c51acc 100644
--- a/mingw-w64-qt5-3d/PKGBUILD
+++ b/mingw-w64-qt5-3d/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="C++ and QML APIs for easy inclusion of 3D graphics (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GPL-2.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-activeqt/PKGBUILD b/mingw-w64-qt5-activeqt/PKGBUILD
index 9559cb38df..fd8477c0fc 100644
--- a/mingw-w64-qt5-activeqt/PKGBUILD
+++ b/mingw-w64-qt5-activeqt/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Qt5 ActiveQt Module - ActiveX components (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:GPL-3.0-only WITH Qt-GPL-exception-1.0 AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-base/PKGBUILD b/mingw-w64-qt5-base/PKGBUILD
index 75c0d355b3..f5e55a9eb3 100644
--- a/mingw-w64-qt5-base/PKGBUILD
+++ b/mingw-w64-qt5-base/PKGBUILD
@@ -20,6 +20,7 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
 msys2_references=(
   'archlinux: qt5-base'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt5-charts/PKGBUILD b/mingw-w64-qt5-charts/PKGBUILD
index 402f6b6e74..21165172f0 100644
--- a/mingw-w64-qt5-charts/PKGBUILD
+++ b/mingw-w64-qt5-charts/PKGBUILD
@@ -9,6 +9,9 @@ pkgrel=1
 pkgdesc="Provides a set of easy to use chart components (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:GPL-3.0-or-later WITH Qt-GPL-exception-1.0')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-base"
diff --git a/mingw-w64-qt5-connectivity/PKGBUILD b/mingw-w64-qt5-connectivity/PKGBUILD
index f93f37ed17..14b7bc9e01 100644
--- a/mingw-w64-qt5-connectivity/PKGBUILD
+++ b/mingw-w64-qt5-connectivity/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="Provides access to Bluetooth hardware (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-datavis3d/PKGBUILD b/mingw-w64-qt5-datavis3d/PKGBUILD
index 4fa98ea699..fc5f95d28d 100644
--- a/mingw-w64-qt5-datavis3d/PKGBUILD
+++ b/mingw-w64-qt5-datavis3d/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Qt Data Visualization module (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:GPL-3.0-or-later WITH Qt-GPL-exception-1.0')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-declarative/PKGBUILD b/mingw-w64-qt5-declarative/PKGBUILD
index f5ce437e15..2eac79accf 100644
--- a/mingw-w64-qt5-declarative/PKGBUILD
+++ b/mingw-w64-qt5-declarative/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="Classes for QML and JavaScript languages (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-base"
diff --git a/mingw-w64-qt5-doc/PKGBUILD b/mingw-w64-qt5-doc/PKGBUILD
index eda18d0a31..e4a4bcfe52 100644
--- a/mingw-w64-qt5-doc/PKGBUILD
+++ b/mingw-w64-qt5-doc/PKGBUILD
@@ -19,6 +19,7 @@ pkgdesc="A cross-platform application and UI framework (Documentation) (mingw-w6
 url='https://www.qt.io/'
 msys2_references=(
   'archlinux: qt5-doc'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:GFDL-1.3-no-invariants-only')
 depends=("${MINGW_PACKAGE_PREFIX}-qt5-base")
diff --git a/mingw-w64-qt5-gamepad/PKGBUILD b/mingw-w64-qt5-gamepad/PKGBUILD
index 13b63418e7..92797232b4 100644
--- a/mingw-w64-qt5-gamepad/PKGBUILD
+++ b/mingw-w64-qt5-gamepad/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Adds support for getting events from gamepad devices (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-graphicaleffects/PKGBUILD b/mingw-w64-qt5-graphicaleffects/PKGBUILD
index 2838df8d6e..0aeabf5570 100644
--- a/mingw-w64-qt5-graphicaleffects/PKGBUILD
+++ b/mingw-w64-qt5-graphicaleffects/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Graphical effects for use with Qt Quick 2 (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-imageformats/PKGBUILD b/mingw-w64-qt5-imageformats/PKGBUILD
index 98a60363f0..4063fa76b5 100644
--- a/mingw-w64-qt5-imageformats/PKGBUILD
+++ b/mingw-w64-qt5-imageformats/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Plugins for additional image formats: TIFF, MNG, TGA, WBMP (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND LGPL-2.1-or-later AND GPL-3.0-or-later AND GPL-2.0-or-later AND GPL-2.0-only AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-base"
diff --git a/mingw-w64-qt5-location/PKGBUILD b/mingw-w64-qt5-location/PKGBUILD
index 67e7834bb6..87501a12ad 100644
--- a/mingw-w64-qt5-location/PKGBUILD
+++ b/mingw-w64-qt5-location/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="Provides access to position, satellite and area monitoring classes (min
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-base"
diff --git a/mingw-w64-qt5-lottie/PKGBUILD b/mingw-w64-qt5-lottie/PKGBUILD
index 11d29b09da..b2753f0401 100644
--- a/mingw-w64-qt5-lottie/PKGBUILD
+++ b/mingw-w64-qt5-lottie/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="A family of player software for a certain json-based file format for de
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:GPL-3.0-or-later WITH Qt-GPL-exception-1.0')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-multimedia/PKGBUILD b/mingw-w64-qt5-multimedia/PKGBUILD
index 42baec5a80..917572e65c 100644
--- a/mingw-w64-qt5-multimedia/PKGBUILD
+++ b/mingw-w64-qt5-multimedia/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Classes for audio, video, radio and camera functionality (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-networkauth/PKGBUILD b/mingw-w64-qt5-networkauth/PKGBUILD
index 1c700a8410..7741b2fcb2 100644
--- a/mingw-w64-qt5-networkauth/PKGBUILD
+++ b/mingw-w64-qt5-networkauth/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Network authentication module (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:GPL-3.0-or-later WITH Qt-GPL-exception-1.0 AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-base"
diff --git a/mingw-w64-qt5-purchasing/PKGBUILD b/mingw-w64-qt5-purchasing/PKGBUILD
index cb636a85f2..026ca9ad60 100644
--- a/mingw-w64-qt5-purchasing/PKGBUILD
+++ b/mingw-w64-qt5-purchasing/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Qt In-App Purchasing API (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-quick3d/PKGBUILD b/mingw-w64-qt5-quick3d/PKGBUILD
index 19b22c9093..e18a72f7e6 100644
--- a/mingw-w64-qt5-quick3d/PKGBUILD
+++ b/mingw-w64-qt5-quick3d/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Qt module and API for defining 3D content in Qt Quick (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:GPL-3.0-or-later WITH Qt-GPL-exception-1.0')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-base"
diff --git a/mingw-w64-qt5-quickcontrols/PKGBUILD b/mingw-w64-qt5-quickcontrols/PKGBUILD
index 46bda42765..14ed65a8d7 100644
--- a/mingw-w64-qt5-quickcontrols/PKGBUILD
+++ b/mingw-w64-qt5-quickcontrols/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Reusable Qt Quick based UI controls to create classic desktop-style use
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-graphicaleffects"
diff --git a/mingw-w64-qt5-quickcontrols2/PKGBUILD b/mingw-w64-qt5-quickcontrols2/PKGBUILD
index 3313876918..7ac2c3842f 100644
--- a/mingw-w64-qt5-quickcontrols2/PKGBUILD
+++ b/mingw-w64-qt5-quickcontrols2/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="Next generation user interface controls based on Qt Quick (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-quicktimeline/PKGBUILD b/mingw-w64-qt5-quicktimeline/PKGBUILD
index 8bcafa752f..b1a67d1b34 100644
--- a/mingw-w64-qt5-quicktimeline/PKGBUILD
+++ b/mingw-w64-qt5-quicktimeline/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Qt module for keyframe-based timeline construction (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:GPL-3.0-or-later WITH Qt-GPL-exception-1.0 AND GPL-2.0-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-remoteobjects/PKGBUILD b/mingw-w64-qt5-remoteobjects/PKGBUILD
index ef0e9b649d..ad7eb2f54f 100644
--- a/mingw-w64-qt5-remoteobjects/PKGBUILD
+++ b/mingw-w64-qt5-remoteobjects/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Inter-process communication (IPC) module developed for Qt (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-script/PKGBUILD b/mingw-w64-qt5-script/PKGBUILD
index 27595f3304..b059175994 100644
--- a/mingw-w64-qt5-script/PKGBUILD
+++ b/mingw-w64-qt5-script/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Classes for making Qt applications scriptable. Provided for Qt 4.x comp
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-base"
diff --git a/mingw-w64-qt5-scxml/PKGBUILD b/mingw-w64-qt5-scxml/PKGBUILD
index 3ad98a7e08..90b9e35860 100644
--- a/mingw-w64-qt5-scxml/PKGBUILD
+++ b/mingw-w64-qt5-scxml/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Static and runtime integration of SCXML models into Qt code (mingw-w64)
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-sensors/PKGBUILD b/mingw-w64-qt5-sensors/PKGBUILD
index bc411726c5..3f2fe3376d 100644
--- a/mingw-w64-qt5-sensors/PKGBUILD
+++ b/mingw-w64-qt5-sensors/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Provides access to sensor hardware and motion gesture recognition (ming
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-serialbus/PKGBUILD b/mingw-w64-qt5-serialbus/PKGBUILD
index a0695a6ced..9a90bc8ff7 100644
--- a/mingw-w64-qt5-serialbus/PKGBUILD
+++ b/mingw-w64-qt5-serialbus/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Qt module for general purpose serial bus access (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-only AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-serialport"
diff --git a/mingw-w64-qt5-serialport/PKGBUILD b/mingw-w64-qt5-serialport/PKGBUILD
index a76f976890..a0340defb2 100644
--- a/mingw-w64-qt5-serialport/PKGBUILD
+++ b/mingw-w64-qt5-serialport/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Provides access to hardware and virtual serial ports (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-base"
diff --git a/mingw-w64-qt5-speech/PKGBUILD b/mingw-w64-qt5-speech/PKGBUILD
index 2b45a4ac91..5fc79f2e5d 100644
--- a/mingw-w64-qt5-speech/PKGBUILD
+++ b/mingw-w64-qt5-speech/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Qt module to make text to speech and speech recognition easy (mingw-w64
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-2.0-only AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-static/PKGBUILD b/mingw-w64-qt5-static/PKGBUILD
index 8d90592fea..8fd1ac66b9 100644
--- a/mingw-w64-qt5-static/PKGBUILD
+++ b/mingw-w64-qt5-static/PKGBUILD
@@ -19,6 +19,7 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
 msys2_references=(
   'archlinux: qt5-base'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:GPL-2.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND LGPL-2.1-or-later AND LGPL-3.0-only AND GFDL-1.3-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-qt5-svg/PKGBUILD b/mingw-w64-qt5-svg/PKGBUILD
index 1f3a88c4cf..cb51f90d09 100644
--- a/mingw-w64-qt5-svg/PKGBUILD
+++ b/mingw-w64-qt5-svg/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="Classes for displaying the contents of SVG files (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0' 'spdx:LGPL-2.1-or-later AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-base"
diff --git a/mingw-w64-qt5-tools/PKGBUILD b/mingw-w64-qt5-tools/PKGBUILD
index 7c81b707ed..37def5bdbe 100644
--- a/mingw-w64-qt5-tools/PKGBUILD
+++ b/mingw-w64-qt5-tools/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="A cross-platform application and UI framework (Development Tools, QtHel
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-translations/PKGBUILD b/mingw-w64-qt5-translations/PKGBUILD
index 673483189f..8d0228d387 100644
--- a/mingw-w64-qt5-translations/PKGBUILD
+++ b/mingw-w64-qt5-translations/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A cross-platform application and UI framework (Translations) (mingw-w64
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0')
 depends=("${MINGW_PACKAGE_PREFIX}-qt5-base")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt5-virtualkeyboard/PKGBUILD b/mingw-w64-qt5-virtualkeyboard/PKGBUILD
index d81b0ac54e..e81d0b76ec 100644
--- a/mingw-w64-qt5-virtualkeyboard/PKGBUILD
+++ b/mingw-w64-qt5-virtualkeyboard/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Virtual keyboard framework (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:GPL-3.0-or-later WITH Qt-GPL-exception-1.0')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-multimedia"
diff --git a/mingw-w64-qt5-webchannel/PKGBUILD b/mingw-w64-qt5-webchannel/PKGBUILD
index f7328c7a9d..bd689f5dbf 100644
--- a/mingw-w64-qt5-webchannel/PKGBUILD
+++ b/mingw-w64-qt5-webchannel/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="Provides access to QObject or QML objects from HTML clients for seamles
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-webglplugin/PKGBUILD b/mingw-w64-qt5-webglplugin/PKGBUILD
index 32c9da6365..fd9ebbaa86 100644
--- a/mingw-w64-qt5-webglplugin/PKGBUILD
+++ b/mingw-w64-qt5-webglplugin/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="QPA plugin for running an application via a browser using streamed WebG
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:GPL-3.0-or-later WITH Qt-GPL-exception-1.0')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-websockets/PKGBUILD b/mingw-w64-qt5-websockets/PKGBUILD
index c21d8ed224..793d1ab44d 100644
--- a/mingw-w64-qt5-websockets/PKGBUILD
+++ b/mingw-w64-qt5-websockets/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="Provides WebSocket communication compliant with RFC 6455 (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-webview/PKGBUILD b/mingw-w64-qt5-webview/PKGBUILD
index 6e07d82528..e6d3a0ed54 100644
--- a/mingw-w64-qt5-webview/PKGBUILD
+++ b/mingw-w64-qt5-webview/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Provides a way to display web content in a QML application (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-only AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-webchannel"
diff --git a/mingw-w64-qt5-winextras/PKGBUILD b/mingw-w64-qt5-winextras/PKGBUILD
index 08e0f1ee3b..8b90af6062 100644
--- a/mingw-w64-qt5-winextras/PKGBUILD
+++ b/mingw-w64-qt5-winextras/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Provides platform-specific APIs for Windows (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt5-xmlpatterns/PKGBUILD b/mingw-w64-qt5-xmlpatterns/PKGBUILD
index 08b2cc3f7a..b0f7e02790 100644
--- a/mingw-w64-qt5-xmlpatterns/PKGBUILD
+++ b/mingw-w64-qt5-xmlpatterns/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Support for XPath, XQuery, XSLT and XML schema validation (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.qt.io/'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND GPL-3.0-or-later AND GPL-2.0-or-later AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-qt5-declarative"
diff --git a/mingw-w64-qt6-3d/PKGBUILD b/mingw-w64-qt6-3d/PKGBUILD
index 9992d51fd7..30476e4397 100644
--- a/mingw-w64-qt6-3d/PKGBUILD
+++ b/mingw-w64-qt6-3d/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qt3d.git"
 msys2_references=(
   'archlinux: qt6-3d'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND CC-BY-4.0 AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-5compat/PKGBUILD b/mingw-w64-qt6-5compat/PKGBUILD
index 4e6d07fb1e..0dc2a9a932 100644
--- a/mingw-w64-qt6-5compat/PKGBUILD
+++ b/mingw-w64-qt6-5compat/PKGBUILD
@@ -13,7 +13,8 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qt.git"
 msys2_references=(
-  'archlinux: qt6-'
+  'archlinux: qt6-5compat'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-activeqt/PKGBUILD b/mingw-w64-qt6-activeqt/PKGBUILD
index e7191bec6c..920c97caf0 100644
--- a/mingw-w64-qt6-activeqt/PKGBUILD
+++ b/mingw-w64-qt6-activeqt/PKGBUILD
@@ -14,6 +14,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_repository_url="https://code.qt.io/cgit/qt/qt.git"
 msys2_references=(
   'aur: mingw-w64-qt6-activeqt'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:GPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-base/PKGBUILD b/mingw-w64-qt6-base/PKGBUILD
index 311cbc3e12..1c3e528673 100644
--- a/mingw-w64-qt6-base/PKGBUILD
+++ b/mingw-w64-qt6-base/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtbase.git"
 msys2_references=(
   'archlinux: qt6-base'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND AFL-2.1 AND Apache-2.0 AND BSL-1.0 AND CC0-1.0 AND BSD-3-Clause AND CC-BY-4.0 AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-2.0-or-later AND GPL-3.0-only AND custom')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-charts/PKGBUILD b/mingw-w64-qt6-charts/PKGBUILD
index 3036f87783..d0e9dced16 100644
--- a/mingw-w64-qt6-charts/PKGBUILD
+++ b/mingw-w64-qt6-charts/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtcharts.git"
 msys2_references=(
   'archlinux: qt6-charts'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:GPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-connectivity/PKGBUILD b/mingw-w64-qt6-connectivity/PKGBUILD
index 449c15bfca..06d1dce13f 100644
--- a/mingw-w64-qt6-connectivity/PKGBUILD
+++ b/mingw-w64-qt6-connectivity/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtconnectivity.git"
 msys2_references=(
   'archlinux: qt6-connectivity'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND Apache-2.0 AND BSD-3-Clause GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-datavis3d/PKGBUILD b/mingw-w64-qt6-datavis3d/PKGBUILD
index c8852dd0fc..41429d97b6 100644
--- a/mingw-w64-qt6-datavis3d/PKGBUILD
+++ b/mingw-w64-qt6-datavis3d/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtdatavis3d.git"
 msys2_references=(
   'archlinux: qt6-datavis3d'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:GPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-declarative/PKGBUILD b/mingw-w64-qt6-declarative/PKGBUILD
index 96381715ed..d029a1dca7 100644
--- a/mingw-w64-qt6-declarative/PKGBUILD
+++ b/mingw-w64-qt6-declarative/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtdeclarative.git"
 msys2_references=(
   'archlinux: qt6-declarative'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-doc/PKGBUILD b/mingw-w64-qt6-doc/PKGBUILD
index ada2216fce..91542016c2 100644
--- a/mingw-w64-qt6-doc/PKGBUILD
+++ b/mingw-w64-qt6-doc/PKGBUILD
@@ -9,6 +9,9 @@ pkgrel=1
 arch=(any)
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://www.qt.io'
+msys2_references=(
+  "cpe: cpe:/a:qt:qt"
+)
 license=(spdx:GFDL-1.3-no-invariants-only)
 pkgdesc='A cross-platform application and UI framework (Documentation) (mingw-w64)'
 makedepends=("${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-qt6-graphs/PKGBUILD b/mingw-w64-qt6-graphs/PKGBUILD
index cf75ec1651..4533943856 100644
--- a/mingw-w64-qt6-graphs/PKGBUILD
+++ b/mingw-w64-qt6-graphs/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtgraphs.git"
 msys2_references=(
   'archlinux: qt6-graphs'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:BSD-3-Clause WITH Qt-GPL-exception-1.0 AND GPL-3.0-only AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-grpc/PKGBUILD b/mingw-w64-qt6-grpc/PKGBUILD
index 82996ed8a9..85a9e1e0db 100644
--- a/mingw-w64-qt6-grpc/PKGBUILD
+++ b/mingw-w64-qt6-grpc/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtgrpc.git"
 msys2_references=(
   'archlinux: qt6-grpc'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-httpserver/PKGBUILD b/mingw-w64-qt6-httpserver/PKGBUILD
index 2614fee22b..af64e49bb2 100644
--- a/mingw-w64-qt6-httpserver/PKGBUILD
+++ b/mingw-w64-qt6-httpserver/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qthttpserver.git"
 msys2_references=(
   'archlinux: qt6-httpserver'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:GPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-imageformats/PKGBUILD b/mingw-w64-qt6-imageformats/PKGBUILD
index 8b5e89dc4c..523d13f23c 100644
--- a/mingw-w64-qt6-imageformats/PKGBUILD
+++ b/mingw-w64-qt6-imageformats/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtimageformats.git"
 msys2_references=(
   'archlinux: qt6-imageformats'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-languageserver/PKGBUILD b/mingw-w64-qt6-languageserver/PKGBUILD
index bdd8c68f12..0d516e56ae 100644
--- a/mingw-w64-qt6-languageserver/PKGBUILD
+++ b/mingw-w64-qt6-languageserver/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtlanguageserver.git"
 msys2_references=(
   'archlinux: qt6-languageserver'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-location/PKGBUILD b/mingw-w64-qt6-location/PKGBUILD
index decb363271..f561b043f3 100644
--- a/mingw-w64-qt6-location/PKGBUILD
+++ b/mingw-w64-qt6-location/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtlocation.git"
 msys2_references=(
   'archlinux: qt6-location'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND Apache-2.0 AND BSD-3-Clause AND BSL-1.0 AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only AND MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-lottie/PKGBUILD b/mingw-w64-qt6-lottie/PKGBUILD
index f5d8ede932..d8a323fe7a 100644
--- a/mingw-w64-qt6-lottie/PKGBUILD
+++ b/mingw-w64-qt6-lottie/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtlottie.git"
 msys2_references=(
   'archlinux: qt6-lottie'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:GPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-multimedia/PKGBUILD b/mingw-w64-qt6-multimedia/PKGBUILD
index 9396bad374..025f8f0c48 100644
--- a/mingw-w64-qt6-multimedia/PKGBUILD
+++ b/mingw-w64-qt6-multimedia/PKGBUILD
@@ -16,6 +16,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtmultimedia.git"
 msys2_references=(
   'archlinux: qt6-multimedia'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-networkauth/PKGBUILD b/mingw-w64-qt6-networkauth/PKGBUILD
index fcfd019a33..67004112d5 100644
--- a/mingw-w64-qt6-networkauth/PKGBUILD
+++ b/mingw-w64-qt6-networkauth/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtnetworkauth.git"
 msys2_references=(
   'archlinux: qt6-networkauth'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:GPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-pdf/PKGBUILD b/mingw-w64-qt6-pdf/PKGBUILD
index 32b501bd01..83f841098e 100644
--- a/mingw-w64-qt6-pdf/PKGBUILD
+++ b/mingw-w64-qt6-pdf/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtwebengine.git"
 msys2_references=(
   'archlinux: qt6-webengine'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-positioning/PKGBUILD b/mingw-w64-qt6-positioning/PKGBUILD
index 6c8c1557b3..48c647b286 100644
--- a/mingw-w64-qt6-positioning/PKGBUILD
+++ b/mingw-w64-qt6-positioning/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtpositioning.git"
 msys2_references=(
   'archlinux: qt6-positioning'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND Apache-2.0 BSD-3-Clause AND CC0-1.0 AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only AND OFL-1.1')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-quick3d/PKGBUILD b/mingw-w64-qt6-quick3d/PKGBUILD
index b05a915941..dcbc429b25 100644
--- a/mingw-w64-qt6-quick3d/PKGBUILD
+++ b/mingw-w64-qt6-quick3d/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtquick3d.git"
 msys2_references=(
   'archlinux: qt6-quick3d'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:GPL-3.0-only WITH Qt-GPL-exception-1.0 AND LGPL-3.0-only AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-quick3dphysics/PKGBUILD b/mingw-w64-qt6-quick3dphysics/PKGBUILD
index f9437cdb8c..912f2883a1 100644
--- a/mingw-w64-qt6-quick3dphysics/PKGBUILD
+++ b/mingw-w64-qt6-quick3dphysics/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtquick3dphysics.git"
 msys2_references=(
   'archlinux: qt6-quick3dphysics'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:GPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-quickeffectmaker/PKGBUILD b/mingw-w64-qt6-quickeffectmaker/PKGBUILD
index 72e616debb..6f23c5ec4a 100644
--- a/mingw-w64-qt6-quickeffectmaker/PKGBUILD
+++ b/mingw-w64-qt6-quickeffectmaker/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtquickeffectmaker.git"
 msys2_references=(
   'archlinux: qt6-quickeffectmaker'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:GPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-quicktimeline/PKGBUILD b/mingw-w64-qt6-quicktimeline/PKGBUILD
index b333e285d0..167c503296 100644
--- a/mingw-w64-qt6-quicktimeline/PKGBUILD
+++ b/mingw-w64-qt6-quicktimeline/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtquicktimeline.git"
 msys2_references=(
   'archlinux: qt6-quicktimeline'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:GPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-remoteobjects/PKGBUILD b/mingw-w64-qt6-remoteobjects/PKGBUILD
index a9e70a89fe..1ce558c923 100644
--- a/mingw-w64-qt6-remoteobjects/PKGBUILD
+++ b/mingw-w64-qt6-remoteobjects/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtremoteobjects.git"
 msys2_references=(
   'archlinux: qt6-remoteobjects'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-scxml/PKGBUILD b/mingw-w64-qt6-scxml/PKGBUILD
index 799fbed6d3..d906f61dbb 100644
--- a/mingw-w64-qt6-scxml/PKGBUILD
+++ b/mingw-w64-qt6-scxml/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtscxml.git"
 msys2_references=(
   'archlinux: qt6-scxml'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-sensors/PKGBUILD b/mingw-w64-qt6-sensors/PKGBUILD
index fabeda7c98..f08dd3eada 100644
--- a/mingw-w64-qt6-sensors/PKGBUILD
+++ b/mingw-w64-qt6-sensors/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtsensors.git"
 msys2_references=(
   'archlinux: qt6-sensors'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-serialbus/PKGBUILD b/mingw-w64-qt6-serialbus/PKGBUILD
index eaef061bb0..45086c7c49 100644
--- a/mingw-w64-qt6-serialbus/PKGBUILD
+++ b/mingw-w64-qt6-serialbus/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtserialbus.git"
 msys2_references=(
   'archlinux: qt6-serialbus'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-serialport/PKGBUILD b/mingw-w64-qt6-serialport/PKGBUILD
index 578a0d7481..c6e01d75b8 100644
--- a/mingw-w64-qt6-serialport/PKGBUILD
+++ b/mingw-w64-qt6-serialport/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtserialport.git"
 msys2_references=(
   'archlinux: qt6-serialport'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-shadertools/PKGBUILD b/mingw-w64-qt6-shadertools/PKGBUILD
index 87baf829cf..3787a86ff0 100644
--- a/mingw-w64-qt6-shadertools/PKGBUILD
+++ b/mingw-w64-qt6-shadertools/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtshadertools.git"
 msys2_references=(
   'archlinux: qt6-shadertools'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-speech/PKGBUILD b/mingw-w64-qt6-speech/PKGBUILD
index 39a0c0ff55..c23b6ddc98 100644
--- a/mingw-w64-qt6-speech/PKGBUILD
+++ b/mingw-w64-qt6-speech/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtspeech.git"
 msys2_references=(
   'archlinux: qt6-speech'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-static/PKGBUILD b/mingw-w64-qt6-static/PKGBUILD
index 3208d2d2dd..3f9af5a1b0 100644
--- a/mingw-w64-qt6-static/PKGBUILD
+++ b/mingw-w64-qt6-static/PKGBUILD
@@ -12,6 +12,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://www.qt.io'
 msys2_references=(
   'archlinux: qt6-base'
+  "cpe: cpe:/a:qt:qt"
 )
 license=(spdx:LGPL-3.0-only WITH spdx:Qt-GPL-exception-1.0 AND spdx:GPL-2.0-or-later AND spdx:GPL-3.0-or-later)
 depends=("${MINGW_PACKAGE_PREFIX}-vulkan-loader")
diff --git a/mingw-w64-qt6-svg/PKGBUILD b/mingw-w64-qt6-svg/PKGBUILD
index 8f8056d307..f0a1d34e8b 100644
--- a/mingw-w64-qt6-svg/PKGBUILD
+++ b/mingw-w64-qt6-svg/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtsvg.git"
 msys2_references=(
   'archlinux: qt6-svg'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-tools/PKGBUILD b/mingw-w64-qt6-tools/PKGBUILD
index 3e705e5bcc..6523fa51fc 100644
--- a/mingw-w64-qt6-tools/PKGBUILD
+++ b/mingw-w64-qt6-tools/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qttools.git"
 msys2_references=(
   'archlinux: qt6-tools'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND BSL-1.0 AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-translations/PKGBUILD b/mingw-w64-qt6-translations/PKGBUILD
index 1f92ca7de9..69f026826d 100644
--- a/mingw-w64-qt6-translations/PKGBUILD
+++ b/mingw-w64-qt6-translations/PKGBUILD
@@ -13,6 +13,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qttranslations.git"
 msys2_references=(
   'archlinux: qt6-translations'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:GPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-qt6-base")
diff --git a/mingw-w64-qt6-virtualkeyboard/PKGBUILD b/mingw-w64-qt6-virtualkeyboard/PKGBUILD
index 24f236aa06..ecc3a04da3 100644
--- a/mingw-w64-qt6-virtualkeyboard/PKGBUILD
+++ b/mingw-w64-qt6-virtualkeyboard/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtvirtualkeyboard.git"
 msys2_references=(
   'archlinux: qt6-virtualkeyboard'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:GPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-webchannel/PKGBUILD b/mingw-w64-qt6-webchannel/PKGBUILD
index 27d9129102..535ad115f9 100644
--- a/mingw-w64-qt6-webchannel/PKGBUILD
+++ b/mingw-w64-qt6-webchannel/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtwebchannel.git"
 msys2_references=(
   'archlinux: qt6-webchannel'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-websockets/PKGBUILD b/mingw-w64-qt6-websockets/PKGBUILD
index 472180fc43..edeeee7ff8 100644
--- a/mingw-w64-qt6-websockets/PKGBUILD
+++ b/mingw-w64-qt6-websockets/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtwebsockets.git"
 msys2_references=(
   'archlinux: qt6-websockets'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qt6-webview/PKGBUILD b/mingw-w64-qt6-webview/PKGBUILD
index 07479208be..c835266fed 100644
--- a/mingw-w64-qt6-webview/PKGBUILD
+++ b/mingw-w64-qt6-webview/PKGBUILD
@@ -14,6 +14,7 @@ url='https://www.qt.io'
 msys2_repository_url="https://code.qt.io/cgit/qt/qtwebview.git"
 msys2_references=(
   'archlinux: qt6-webview'
+  "cpe: cpe:/a:qt:qt"
 )
 license=('spdx:LGPL-3.0-only WITH Qt-GPL-exception-1.0 AND BSD-3-Clause AND GFDL-1.3-no-invariants-only AND GPL-2.0-only AND GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-qtwebkit/PKGBUILD b/mingw-w64-qtwebkit/PKGBUILD
index ca712c1498..771b560835 100644
--- a/mingw-w64-qtwebkit/PKGBUILD
+++ b/mingw-w64-qtwebkit/PKGBUILD
@@ -12,6 +12,7 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64')
 url="https://github.com/qtwebkit/qtwebkit/wiki"
 msys2_references=(
   'archlinux: qt5-webkit'
+  "cpe: cpe:/a:qt:qtwebkit"
 )
 license=(GPL3 LGPL3 FDL custom)
 makedepends=("${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-quassel/PKGBUILD b/mingw-w64-quassel/PKGBUILD
index d513f651d4..59208664eb 100644
--- a/mingw-w64-quassel/PKGBUILD
+++ b/mingw-w64-quassel/PKGBUILD
@@ -13,6 +13,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: quassel-client'
+  "cpe: cpe:/a:quassel-irc:quassel"
 )
 url="https://quassel-irc.org/"
 license=('GPL')
diff --git a/mingw-w64-rabbitmq-c/PKGBUILD b/mingw-w64-rabbitmq-c/PKGBUILD
index f218f569de..9be9227042 100644
--- a/mingw-w64-rabbitmq-c/PKGBUILD
+++ b/mingw-w64-rabbitmq-c/PKGBUILD
@@ -11,6 +11,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://github.com/alanxz/rabbitmq-c'
 msys2_references=(
   'archlinux: librabbitmq-c'
+  "cpe: cpe:/a:rabbitmq-c_project:rabbitmq-c"
 )
 license=('spdx:MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-raylib/PKGBUILD b/mingw-w64-raylib/PKGBUILD
index df34844f27..f313269514 100644
--- a/mingw-w64-raylib/PKGBUILD
+++ b/mingw-w64-raylib/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: raylib'
+  "cpe: cpe:/a:raylib:raylib"
 )
 msys2_repository_url='https://github.com/raysan5/raylib/'
 url='https://www.raylib.com/'
diff --git a/mingw-w64-rclone/PKGBUILD b/mingw-w64-rclone/PKGBUILD
index dde3024d7b..957261cb47 100644
--- a/mingw-w64-rclone/PKGBUILD
+++ b/mingw-w64-rclone/PKGBUILD
@@ -13,6 +13,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://rclone.org/'
 msys2_references=(
   'archlinux: rclone'
+  "cpe: cpe:/a:rclone:rclone"
 )
 msys2_repository_url='https://github.com/rclone/rclone/'
 msys2_changelog_url='https://rclone.org/changelog/'
diff --git a/mingw-w64-readline/PKGBUILD b/mingw-w64-readline/PKGBUILD
index 4e2d5d4c3a..cb98821f73 100644
--- a/mingw-w64-readline/PKGBUILD
+++ b/mingw-w64-readline/PKGBUILD
@@ -19,6 +19,9 @@ options=('staticlibs' 'strip')
 license=('spdx:GPL-3.0-or-later')
 url="https://tiswww.case.edu/php/chet/readline/rltop.html"
 msys2_repository_url="https://git.savannah.gnu.org/cgit/readline.git"
+msys2_references=(
+  "cpe: cpe:/a:gnu:readline"
+)
 source=("https://ftp.gnu.org/gnu/${_realname}/${_realname}-${_basever}.tar.gz"{,.sig}
         # Patch adopted from https://hg.octave.org/mxe-octave/file/41e50d658de0/src/readline-1-sigwinch.patch
         "0001-sigwinch.patch"
diff --git a/mingw-w64-riscv64-unknown-elf-binutils/PKGBUILD b/mingw-w64-riscv64-unknown-elf-binutils/PKGBUILD
index 72e6f18118..3195179cfc 100644
--- a/mingw-w64-riscv64-unknown-elf-binutils/PKGBUILD
+++ b/mingw-w64-riscv64-unknown-elf-binutils/PKGBUILD
@@ -13,6 +13,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 license=('spdx:GPL-3.0-or-later AND GPL-2.0-or-later AND LGPL-3.0-or-later AND LGPL-2.0-or-later')
 url='https://www.gnu.org/software/binutils/binutils.html'
+msys2_references=(
+  "cpe: cpe:/a:gnu:binutils"
+)
 groups=("${MINGW_PACKAGE_PREFIX}-${_target}-toolchain")
 depends=("${MINGW_PACKAGE_PREFIX}-zstd")
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-riscv64-unknown-elf-gcc/PKGBUILD b/mingw-w64-riscv64-unknown-elf-gcc/PKGBUILD
index 6f4ea85bdf..d45a82e7b9 100644
--- a/mingw-w64-riscv64-unknown-elf-gcc/PKGBUILD
+++ b/mingw-w64-riscv64-unknown-elf-gcc/PKGBUILD
@@ -18,6 +18,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64')
 license=('GPL')
 url='https://www.gnu.org/software/gcc/gcc.html'
+msys2_references=(
+  "cpe: cpe:/a:gnu:gcc"
+)
 groups=("${MINGW_PACKAGE_PREFIX}-${_target}-toolchain")
 provides=($([[ "$_enable_ada" == "yes" ]] && echo "${MINGW_PACKAGE_PREFIX}-${_target}-gcc-ada"))
 depends=(
diff --git a/mingw-w64-rrdtool/PKGBUILD b/mingw-w64-rrdtool/PKGBUILD
index 8a42b1951f..abefd88d64 100644
--- a/mingw-w64-rrdtool/PKGBUILD
+++ b/mingw-w64-rrdtool/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Round Robin Database (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://oss.oetiker.ch/rrdtool/'
+msys2_references=(
+  "cpe: cpe:/a:rrdtool_project:rrdtool"
+)
 license=('GPL2')
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools"
              "${MINGW_PACKAGE_PREFIX}-cc")
diff --git a/mingw-w64-rtmpdump/PKGBUILD b/mingw-w64-rtmpdump/PKGBUILD
index 15949025cf..45b5699163 100644
--- a/mingw-w64-rtmpdump/PKGBUILD
+++ b/mingw-w64-rtmpdump/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A tool to download rtmp streams (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://rtmpdump.mplayerhq.hu/"
+msys2_references=(
+  "cpe: cpe:/a:rtmpdump_project:rtmpdump"
+)
 license=('GPL2' 'LGPL2.1')
 provides=("${MINGW_PACKAGE_PREFIX}-${_realname}-git")
 conflicts=("${MINGW_PACKAGE_PREFIX}-${_realname}-git")
diff --git a/mingw-w64-ruby/PKGBUILD b/mingw-w64-ruby/PKGBUILD
index 4a5bba3d9e..73ef567d3f 100644
--- a/mingw-w64-ruby/PKGBUILD
+++ b/mingw-w64-ruby/PKGBUILD
@@ -15,6 +15,10 @@ pkgdesc="An object-oriented language for quick and easy programming (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.ruby-lang.org/en"
+msys2_references=(
+  "cpe: cpe:/a:ruby-lang:ruby"
+  "cpe: cpe:/a:yukihiro_matsumoto:ruby"
+)
 license=("BSD, custom")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-rust/PKGBUILD b/mingw-w64-rust/PKGBUILD
index ed6f6d478a..35999265e1 100644
--- a/mingw-w64-rust/PKGBUILD
+++ b/mingw-w64-rust/PKGBUILD
@@ -21,6 +21,7 @@ url="https://www.rust-lang.org/"
 msys2_repository_url="https://github.com/rust-lang/rust"
 msys2_references=(
   'archlinux: rust'
+  "cpe: cpe:/a:rust-lang:rust"
 )
 license=('spdx:Apache-2.0 AND MIT')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-rxspencer/PKGBUILD b/mingw-w64-rxspencer/PKGBUILD
index b08d1fd77e..e32fdf425d 100644
--- a/mingw-w64-rxspencer/PKGBUILD
+++ b/mingw-w64-rxspencer/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Henry Spencer's BSD regular expression library modified to allow buildi
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url="https://garyhouston.github.io/regex/"
+msys2_references=(
+  "cpe: cpe:/a:rxspencer_project:rxspencer"
+)
 options=('strip' 'staticlibs')
 license=('custom')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-sassc/PKGBUILD b/mingw-w64-sassc/PKGBUILD
index 778a9a9311..c9a53fd7c5 100644
--- a/mingw-w64-sassc/PKGBUILD
+++ b/mingw-w64-sassc/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="C implementation of Sass CSS preprocessor (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://sass-lang.com/libsass#sassc"
+msys2_references=(
+  "cpe: cpe:/a:sass-lang:sassc"
+)
 license=("MIT")
 depends=("${MINGW_PACKAGE_PREFIX}-libsass")
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-soundtouch/PKGBUILD b/mingw-w64-soundtouch/PKGBUILD
index 80126edc6d..b4785ac97c 100644
--- a/mingw-w64-soundtouch/PKGBUILD
+++ b/mingw-w64-soundtouch/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="An audio processing library (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.surina.net/soundtouch/"
+msys2_references=(
+  "cpe: cpe:/a:surina:soundtouch"
+)
 license=("LGPL")
 makedepends=("${MINGW_PACKAGE_PREFIX}-autotools"
              "${MINGW_PACKAGE_PREFIX}-cc")
diff --git a/mingw-w64-sox/PKGBUILD b/mingw-w64-sox/PKGBUILD
index 6f78b4963c..a56cd21c21 100644
--- a/mingw-w64-sox/PKGBUILD
+++ b/mingw-w64-sox/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="SoX is the Swiss Army Knife of sound processing utilities (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://sourceforge.net/projects/sox/"
+msys2_references=(
+  "cpe: cpe:/a:sox_project:sox"
+)
 license=("GPL")
 makedepends=(autoconf-archive git
              "${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-speex/PKGBUILD b/mingw-w64-speex/PKGBUILD
index 90c18085a6..0ffec57bb3 100644
--- a/mingw-w64-speex/PKGBUILD
+++ b/mingw-w64-speex/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('BSD')
 url="https://speex.org/"
+msys2_references=(
+  "cpe: cpe:/a:xiph:speex"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-libogg" "${MINGW_PACKAGE_PREFIX}-speexdsp")
 options=('strip' '!libtool' 'staticlibs')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-spice-gtk/PKGBUILD b/mingw-w64-spice-gtk/PKGBUILD
index 5cfffcfcf4..8901e09e54 100644
--- a/mingw-w64-spice-gtk/PKGBUILD
+++ b/mingw-w64-spice-gtk/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="GTK3 widget for SPICE clients (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.spice-space.org/"
+msys2_references=(
+  "cpe: cpe:/a:spice-gtk_project:spice-gtk"
+)
 license=("GPL2")
 depends=("${MINGW_PACKAGE_PREFIX}-cyrus-sasl"
          "${MINGW_PACKAGE_PREFIX}-dbus-glib"
diff --git a/mingw-w64-spice/PKGBUILD b/mingw-w64-spice/PKGBUILD
index 078c9dfa96..e86e323f6e 100644
--- a/mingw-w64-spice/PKGBUILD
+++ b/mingw-w64-spice/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="SPICE: Simple Protocol for Independent Computing Environments (mingw-w6
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.spice-space.org/"
+msys2_references=(
+  "cpe: cpe:/a:spice_project:spice"
+)
 license=('spdx:LGPL-2.1-or-later')
 depends=(
              "${MINGW_PACKAGE_PREFIX}-glib2"
diff --git a/mingw-w64-sqlcipher/PKGBUILD b/mingw-w64-sqlcipher/PKGBUILD
index 8cd7395d40..3b2ab136dd 100644
--- a/mingw-w64-sqlcipher/PKGBUILD
+++ b/mingw-w64-sqlcipher/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.zetetic.net/sqlcipher/"
 msys2_repository_url="https://github.com/sqlcipher/sqlcipher"
+msys2_references=(
+  "cpe: cpe:/a:zetetic:sqlcipher"
+)
 license=('spdx:BSD-3-Clause-Clear')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-openssl"
diff --git a/mingw-w64-sqlite3/PKGBUILD b/mingw-w64-sqlite3/PKGBUILD
index 782ac85c78..7be9cde25d 100644
--- a/mingw-w64-sqlite3/PKGBUILD
+++ b/mingw-w64-sqlite3/PKGBUILD
@@ -16,6 +16,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_references=(
   'archlinux: sqlite'
+  "cpe: cpe:/a:sqlite:sqlite"
 )
 msys2_repository_url="https://www.sqlite.org/cgi/src/dir?ci=trunk"
 license=(PublicDomain)
diff --git a/mingw-w64-squirrel/PKGBUILD b/mingw-w64-squirrel/PKGBUILD
index 3125225ae3..ef429d101c 100644
--- a/mingw-w64-squirrel/PKGBUILD
+++ b/mingw-w64-squirrel/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A light-weight scripting language that fits in the size, memory bandwid
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='http://www.squirrel-lang.org'
+msys2_references=(
+  "cpe: cpe:/a:squirrel-lang:squirrel"
+)
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-stb/PKGBUILD b/mingw-w64-stb/PKGBUILD
index c540dc8e90..a86d2cc7ab 100644
--- a/mingw-w64-stb/PKGBUILD
+++ b/mingw-w64-stb/PKGBUILD
@@ -10,6 +10,10 @@ pkgdesc="single-file public domain (or MIT licensed) libraries for C/C++"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/nothings/stb"
+msys2_references=(
+  "cpe: cpe:/a:stb_project:stb"
+  "cpe: cpe:/a:stb_vorbis_project:stb_vorbis"
+)
 license=('spdx:Unlicense' 'spdx:MIT')
 makedepends=('git')
 source=("git+https://github.com/nothings/${_realname}#commit=${_commit}")
diff --git a/mingw-w64-swi-prolog/PKGBUILD b/mingw-w64-swi-prolog/PKGBUILD
index 595cddb6ba..0f6901cfa8 100755
--- a/mingw-w64-swi-prolog/PKGBUILD
+++ b/mingw-w64-swi-prolog/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Prolog environment (mingw-w64)"
 arch=(any)
 mingw_arch=('mingw64' 'ucrt64' 'clang64')
 url="https://www.swi-prolog.org/"
+msys2_references=(
+  "cpe: cpe:/a:swi-prolog:swi-prolog"
+)
 license=('spdx:BSD-2-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-libwinpthread-git"
diff --git a/mingw-w64-taglib/PKGBUILD b/mingw-w64-taglib/PKGBUILD
index 95e8efa6cf..20c58c5417 100644
--- a/mingw-w64-taglib/PKGBUILD
+++ b/mingw-w64-taglib/PKGBUILD
@@ -10,6 +10,10 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://taglib.org/"
 msys2_repository_url="https://github.com/taglib/taglib"
+msys2_references=(
+  "cpe: cpe:/a:scott_wheeler:taglib"
+  "cpe: cpe:/a:taglib:taglib"
+)
 license=('spdx:LGPL-2.1-or-later' 'spdx:MPL-1.1')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-tcl/PKGBUILD b/mingw-w64-tcl/PKGBUILD
index 6da5774261..d8a3b4cf51 100644
--- a/mingw-w64-tcl/PKGBUILD
+++ b/mingw-w64-tcl/PKGBUILD
@@ -15,6 +15,9 @@ makedepends=("${MINGW_PACKAGE_PREFIX}-cc" "${MINGW_PACKAGE_PREFIX}-autotools")
 options=('staticlibs' '!makeflags') # '!strip' 'debug')
 license=("custom")
 url="https://tcl.sourceforge.io/"
+msys2_references=(
+  "cpe: cpe:/a:tcl:tcl"
+)
 source=("https://downloads.sourceforge.net/sourceforge/tcl/tcl${pkgver}-src.tar.gz"
         001-fix-relocation.patch
         002-fix-forbidden-colon-in-paths.mingw.patch
diff --git a/mingw-w64-tesseract-ocr/PKGBUILD b/mingw-w64-tesseract-ocr/PKGBUILD
index 92dbbb3dc6..faa81058d6 100644
--- a/mingw-w64-tesseract-ocr/PKGBUILD
+++ b/mingw-w64-tesseract-ocr/PKGBUILD
@@ -11,6 +11,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: tesseract'
+  "cpe: cpe:/a:tesseract_project:tesseract"
 )
 url="https://github.com/tesseract-ocr/tesseract"
 license=("spdx:Apache-2.0")
diff --git a/mingw-w64-texlive-bin/PKGBUILD b/mingw-w64-texlive-bin/PKGBUILD
index ad0e578e35..68712f2306 100644
--- a/mingw-w64-texlive-bin/PKGBUILD
+++ b/mingw-w64-texlive-bin/PKGBUILD
@@ -9,6 +9,9 @@ license=('GPL')
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64')
 url='https://tug.org/texlive/'
+msys2_references=(
+  "cpe: cpe:/a:tug:texlive"
+)
 makedepends=(
     "${MINGW_PACKAGE_PREFIX}-perl"
     "${MINGW_PACKAGE_PREFIX}-cairo"
diff --git a/mingw-w64-texlive-core/PKGBUILD b/mingw-w64-texlive-core/PKGBUILD
index 9d9d47aece..0541b14628 100644
--- a/mingw-w64-texlive-core/PKGBUILD
+++ b/mingw-w64-texlive-core/PKGBUILD
@@ -55,6 +55,9 @@ replaces=(
     "${MINGW_PACKAGE_PREFIX}-texlive-latex-base"
 )
 url='https://tug.org/texlive/'
+msys2_references=(
+  "cpe: cpe:/a:tug:texlive"
+)
 source=("${_realname}-${_revnr}.tar.xz::https://github.com/msys2/msys2-texlive/releases/download/${_revnr}/texlive-core-${_revnr}.tar.xz"
     "${_realname}-extra-files.tar.xz::https://github.com/msys2/msys2-texlive/releases/download/${_revnr}/${_realname}-extra-files.tar.xz"
     "mktexlsr.hook.in"
diff --git a/mingw-w64-thrift/PKGBUILD b/mingw-w64-thrift/PKGBUILD
index 516a86d31f..e4b392714c 100644
--- a/mingw-w64-thrift/PKGBUILD
+++ b/mingw-w64-thrift/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc="Apache Thrift is a software framework for scalable cross-language servi
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://thrift.apache.org/'
+msys2_references=(
+  "cpe: cpe:/a:apache:thrift"
+)
 license=('spdx:Apache-2.0')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-openssl"
diff --git a/mingw-w64-tidy/PKGBUILD b/mingw-w64-tidy/PKGBUILD
index cb7b6e8745..b374fb010f 100644
--- a/mingw-w64-tidy/PKGBUILD
+++ b/mingw-w64-tidy/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A tool to tidy down your HTML code to a clean style (mingw-w64)"
 arch=(any)
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.html-tidy.org/"
+msys2_references=(
+  "cpe: cpe:/a:htacg:tidy"
+)
 license=(custom)
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=(
diff --git a/mingw-w64-tinyxml/PKGBUILD b/mingw-w64-tinyxml/PKGBUILD
index 76238da9e9..feaa554656 100644
--- a/mingw-w64-tinyxml/PKGBUILD
+++ b/mingw-w64-tinyxml/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Simple, small, C++ XML parser that can be easily integrated into other
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="http://www.grinninglizard.com/tinyxml"
+msys2_references=(
+  "cpe: cpe:/a:tinyxml_project:tinyxml"
+)
 license=('spdx:Zlib')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
diff --git a/mingw-w64-tinyxml2/PKGBUILD b/mingw-w64-tinyxml2/PKGBUILD
index 44e5062067..95b4a46578 100644
--- a/mingw-w64-tinyxml2/PKGBUILD
+++ b/mingw-w64-tinyxml2/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Simple, small, C++ XML parser that can be easily integrated into other
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="http://www.grinninglizard.com/tinyxml2/index.html"
+msys2_references=(
+  "cpe: cpe:/a:tinyxml_project:tinyxml"
+)
 license=('spdx:Zlib')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-tor/PKGBUILD b/mingw-w64-tor/PKGBUILD
index 142f63b352..b5f92ebdc7 100644
--- a/mingw-w64-tor/PKGBUILD
+++ b/mingw-w64-tor/PKGBUILD
@@ -12,6 +12,9 @@ url='https://www.torproject.org/'
 msys2_repository_url='https://gitlab.torproject.org/tpo/core/tor/'
 msys2_references=(
   'archlinux: tor'
+  "cpe: cpe:/a:tor:tor"
+  "cpe: cpe:/a:tor_project:tor"
+  "cpe: cpe:/a:torproject:tor"
 )
 license=('spdx:BSD-3-Clause')
 depends=("${MINGW_PACKAGE_PREFIX}-libevent"
diff --git a/mingw-w64-transmission/PKGBUILD b/mingw-w64-transmission/PKGBUILD
index 1ebda82d34..8eb3a7751b 100644
--- a/mingw-w64-transmission/PKGBUILD
+++ b/mingw-w64-transmission/PKGBUILD
@@ -11,6 +11,7 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 msys2_references=(
   'archlinux: transmission-gtk'
+  "cpe: cpe:/a:transmissionbt:transmission"
 )
 url='https://www.transmissionbt.com/'
 license=('spdx:GPL-2.0-or-later AND GPL-3.0-or-later')
diff --git a/mingw-w64-unbound/PKGBUILD b/mingw-w64-unbound/PKGBUILD
index d273bb2a01..b69050e70d 100644
--- a/mingw-w64-unbound/PKGBUILD
+++ b/mingw-w64-unbound/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="Validating, recursive, and caching DNS resolver (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://unbound.net/'
+msys2_references=(
+  "cpe: cpe:/a:nlnetlabs:unbound"
+  "cpe: cpe:/a:unbound:unbound"
+)
 license=('spdx:BSD-3-Clause')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-autotools")
diff --git a/mingw-w64-unicorn/PKGBUILD b/mingw-w64-unicorn/PKGBUILD
index d09673be08..c37bf0a835 100644
--- a/mingw-w64-unicorn/PKGBUILD
+++ b/mingw-w64-unicorn/PKGBUILD
@@ -11,6 +11,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://www.unicorn-engine.org'
 msys2_repository_url="https://github.com/unicorn-engine/unicorn"
+msys2_references=(
+  "cpe: cpe:/a:unicorn-engine:unicorn_engine"
+)
 license=('spdx:GPL-2.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-libwinpthread-git")
diff --git a/mingw-w64-unixodbc/PKGBUILD b/mingw-w64-unixodbc/PKGBUILD
index 49662c5236..d778205937 100644
--- a/mingw-w64-unixodbc/PKGBUILD
+++ b/mingw-w64-unixodbc/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="ODBC is an open specification for providing application developers with
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="http://www.unixodbc.org/"
+msys2_references=(
+  "cpe: cpe:/a:unixodbc:unixodbc"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
          "${MINGW_PACKAGE_PREFIX}-readline"
          "${MINGW_PACKAGE_PREFIX}-libltdl"
diff --git a/mingw-w64-unrar/PKGBUILD b/mingw-w64-unrar/PKGBUILD
index 23c1998f7d..291fdebf7b 100644
--- a/mingw-w64-unrar/PKGBUILD
+++ b/mingw-w64-unrar/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='The RAR uncompression program (mingw-w64)'
 arch=(any)
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.rarlab.com/rar_add.htm'
+msys2_references=(
+  "cpe: cpe:/a:rarlab:unrar"
+)
 license=('custom')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc")
diff --git a/mingw-w64-upx/PKGBUILD b/mingw-w64-upx/PKGBUILD
index 1ead88c653..ad305c82df 100644
--- a/mingw-w64-upx/PKGBUILD
+++ b/mingw-w64-upx/PKGBUILD
@@ -8,6 +8,9 @@ pkgrel=1
 pkgdesc='Ultimate executable compressor.'
 arch=('any')
 url='https://upx.github.io/'
+msys2_references=(
+  "cpe: cpe:/a:upx_project:upx"
+)
 license=('spdx:GPL-2.0-or-later')
 depends=(
   "${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-uriparser/PKGBUILD b/mingw-w64-uriparser/PKGBUILD
index 41c1b2e6b6..7a1b5247d1 100644
--- a/mingw-w64-uriparser/PKGBUILD
+++ b/mingw-w64-uriparser/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="RFC 3986 URI parsing and processing libary (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://uriparser.github.io/"
+msys2_references=(
+  "cpe: cpe:/a:uriparser_project:uriparser"
+)
 license=('spdx:BSD-3-Clause')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-cmake"
diff --git a/mingw-w64-usbredir/PKGBUILD b/mingw-w64-usbredir/PKGBUILD
index 43cdef73da..8639d51323 100644
--- a/mingw-w64-usbredir/PKGBUILD
+++ b/mingw-w64-usbredir/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Parser for the usbredir protocol (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.spice-space.org/"
+msys2_references=(
+  "cpe: cpe:/a:spice-space:usbredir"
+)
 license=("spdx:GPL-2.0-or-later AND LGPL-2.1-or-later")
 depends=(
   "${MINGW_PACKAGE_PREFIX}-libusb"
diff --git a/mingw-w64-usrsctp/PKGBUILD b/mingw-w64-usrsctp/PKGBUILD
index 7eba6f42a3..3a13f4f932 100644
--- a/mingw-w64-usrsctp/PKGBUILD
+++ b/mingw-w64-usrsctp/PKGBUILD
@@ -10,6 +10,7 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 msys2_references=(
   'aur: libusrsctp'
+  "cpe: cpe:/a:usrsctp_project:usrsctp"
 )
 url='https://github.com/sctplab/usrsctp'
 license=('spdx:BSD-3-Clause')
diff --git a/mingw-w64-v8/PKGBUILD b/mingw-w64-v8/PKGBUILD
index 4a49893717..55cc38cd67 100644
--- a/mingw-w64-v8/PKGBUILD
+++ b/mingw-w64-v8/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc="Fast and modern Javascript engine (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://v8.dev"
+msys2_references=(
+  "cpe: cpe:/a:google:v8"
+)
 license=('spdx:BSD-3-Clause')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-gn"
diff --git a/mingw-w64-vala/PKGBUILD b/mingw-w64-vala/PKGBUILD
index f333527438..8c1048f1de 100644
--- a/mingw-w64-vala/PKGBUILD
+++ b/mingw-w64-vala/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Compiler for the GObject type system (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://wiki.gnome.org/Projects/Vala"
+msys2_references=(
+  "cpe: cpe:/a:gnome:vala"
+)
 license=("LGPL")
 makedepends=("help2man"
              "${MINGW_PACKAGE_PREFIX}-libxslt"
diff --git a/mingw-w64-virglrenderer/PKGBUILD b/mingw-w64-virglrenderer/PKGBUILD
index 3a37724845..476171810f 100644
--- a/mingw-w64-virglrenderer/PKGBUILD
+++ b/mingw-w64-virglrenderer/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc='A virtual 3D GPU library, that allows the guest operating system to use
 arch=('any')
 mingw_arch=('mingw64' 'mingw32' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url='https://virgil3d.github.io/'
+msys2_references=(
+  "cpe: cpe:/a:virglrenderer_project:virglrenderer"
+)
 license=(MIT)
 depends=("${MINGW_PACKAGE_PREFIX}-libepoxy")
 makedepends=("${MINGW_PACKAGE_PREFIX}-python"
diff --git a/mingw-w64-vlc/PKGBUILD b/mingw-w64-vlc/PKGBUILD
index 171ec793f1..7043fb504a 100644
--- a/mingw-w64-vlc/PKGBUILD
+++ b/mingw-w64-vlc/PKGBUILD
@@ -13,6 +13,10 @@ pkgdesc="A multi-platform MPEG, VCD/DVD, and DivX player (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.videolan.org/vlc/"
+msys2_references=(
+  "cpe: cpe:/a:videolan:vlc"
+  "cpe: cpe:/a:videolan:vlc_media_player"
+)
 install=vlc-${MSYSTEM}.install
 license=('spdx:LGPL-2.1-or-later OR spdx:GPL-2.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-a52dec"
diff --git a/mingw-w64-vtk/PKGBUILD b/mingw-w64-vtk/PKGBUILD
index 58bb8583a7..a4c3d3dee0 100644
--- a/mingw-w64-vtk/PKGBUILD
+++ b/mingw-w64-vtk/PKGBUILD
@@ -13,6 +13,7 @@ url="https://www.vtk.org/"
 msys2_repository_url="https://gitlab.kitware.com/vtk/vtk"
 msys2_references=(
   'archlinux: vtk'
+  "cpe: cpe:/a:vtk:vtk"
 )
 license=("spdx:BSD-3-Clause")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs"
diff --git a/mingw-w64-wavpack/PKGBUILD b/mingw-w64-wavpack/PKGBUILD
index 3d33bd1a2d..4bb8e8c9f5 100644
--- a/mingw-w64-wavpack/PKGBUILD
+++ b/mingw-w64-wavpack/PKGBUILD
@@ -10,6 +10,10 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 msys2_repository_url='https://github.com/dbry/WavPack/'
 url="https://www.wavpack.com/"
+msys2_references=(
+  "cpe: cpe:/a:wavpack:wavpack"
+  "cpe: cpe:/a:wavpack_project:wavpack"
+)
 license=('spdx:BSD-3-Clause')
 makedepends=(
   "${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-wget/PKGBUILD b/mingw-w64-wget/PKGBUILD
index 8482c0b3a0..a3b0e8d44d 100644
--- a/mingw-w64-wget/PKGBUILD
+++ b/mingw-w64-wget/PKGBUILD
@@ -10,6 +10,9 @@ pkgdesc='Wget retrieves files using HTTP, HTTPS and FTP (mingw-w64)'
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 url='https://www.gnu.org/software/wget/'
+msys2_references=(
+  "cpe: cpe:/a:gnu:wget"
+)
 license=('spdx:GPL-3.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-pcre2"
          "${MINGW_PACKAGE_PREFIX}-libidn2"
diff --git a/mingw-w64-wget2/PKGBUILD b/mingw-w64-wget2/PKGBUILD
index c5ce578ad7..225d83abc9 100644
--- a/mingw-w64-wget2/PKGBUILD
+++ b/mingw-w64-wget2/PKGBUILD
@@ -10,6 +10,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url='https://www.gnu.org/software/wget/'
 msys2_repository_url="https://gitlab.com/gnuwget/wget2"
+msys2_references=(
+  "cpe: cpe:/a:gnu:wget"
+)
 license=('spdx:GPL-3.0-or-later AND LGPL-3.0-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-brotli"
          "${MINGW_PACKAGE_PREFIX}-bzip2"
diff --git a/mingw-w64-wireshark/PKGBUILD b/mingw-w64-wireshark/PKGBUILD
index 203f49a8a3..6dbde23114 100644
--- a/mingw-w64-wireshark/PKGBUILD
+++ b/mingw-w64-wireshark/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Network traffic and protocol analyzer/sniffer (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.wireshark.org"
+msys2_references=(
+  "cpe: cpe:/a:wireshark:wireshark"
+)
 license=('GPL2')
 depends=("${MINGW_PACKAGE_PREFIX}-bcg729"
          "${MINGW_PACKAGE_PREFIX}-brotli"
diff --git a/mingw-w64-wkhtmltopdf-git/PKGBUILD b/mingw-w64-wkhtmltopdf-git/PKGBUILD
index beebafd318..6f51508459 100644
--- a/mingw-w64-wkhtmltopdf-git/PKGBUILD
+++ b/mingw-w64-wkhtmltopdf-git/PKGBUILD
@@ -12,6 +12,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64')
 url="https://wkhtmltopdf.org/"
 msys2_repository_url="https://github.com/wkhtmltopdf/wkhtmltopdf"
+msys2_references=(
+  "cpe: cpe:/a:wkhtmltopdf:wkhtmltopdf"
+)
 license=('spdx:LGPL-3.0-only')
 makedepends=("git" "${MINGW_PACKAGE_PREFIX}-cc")
 depends=("${MINGW_PACKAGE_PREFIX}-qt5-svg"
diff --git a/mingw-w64-wxwidgets3.0/PKGBUILD b/mingw-w64-wxwidgets3.0/PKGBUILD
index 32305e9d4e..da4c13f4cb 100644
--- a/mingw-w64-wxwidgets3.0/PKGBUILD
+++ b/mingw-w64-wxwidgets3.0/PKGBUILD
@@ -17,6 +17,7 @@ mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.wxwidgets.org/"
 msys2_references=(
   'archlinux'
+  "cpe: cpe:/a:wxwidgets:wxwidgets"
 )
 license=("spdx:GPL-2.0-or-later AND WxWindows-exception-3.1")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-wxwidgets3.2/PKGBUILD b/mingw-w64-wxwidgets3.2/PKGBUILD
index 1be79f1314..3d056797bb 100644
--- a/mingw-w64-wxwidgets3.2/PKGBUILD
+++ b/mingw-w64-wxwidgets3.2/PKGBUILD
@@ -19,6 +19,9 @@ pkgdesc="A C++ library that lets developers create applications for Windows, Lin
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://wxwidgets.org/"
+msys2_references=(
+  "cpe: cpe:/a:wxwidgets:wxwidgets"
+)
 license=('spdx:wxWindows')
 makedepends=(
   "${MINGW_PACKAGE_PREFIX}-autotools"
diff --git a/mingw-w64-x265/PKGBUILD b/mingw-w64-x265/PKGBUILD
index d68bdeef43..6651bce6b1 100644
--- a/mingw-w64-x265/PKGBUILD
+++ b/mingw-w64-x265/PKGBUILD
@@ -19,6 +19,10 @@ makedepends=(
 )
 options=('strip')
 url='https://bitbucket.org/multicoreware/x265_git'
+msys2_references=(
+  "cpe: cpe:/a:multicorewareinc:x265"
+  "cpe: cpe:/a:multicorewareinc:x265_high_efficiency_video_coding"
+)
 source=("${_realname}-${pkgver}.tar.gz"::"https://bitbucket.org/multicoreware/x265_git/get/${pkgver}.tar.gz"
         0001-fix-windows-arm64-detection.patch)
 sha256sums=('5ca3403c08de4716719575ec56c686b1eb55b078c0fe50a064dcf1ac20af1618'
diff --git a/mingw-w64-xapian-core/PKGBUILD b/mingw-w64-xapian-core/PKGBUILD
index a84be937aa..4edbbe547b 100644
--- a/mingw-w64-xapian-core/PKGBUILD
+++ b/mingw-w64-xapian-core/PKGBUILD
@@ -11,6 +11,9 @@ pkgdesc='Open source search engine library (mingw-w64)'
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://www.xapian.org/'
+msys2_references=(
+  "cpe: cpe:/a:xapian:xapian-core"
+)
 license=('spdx:GPL-2.0-or-later')
 # xapian config requires libxapian.la
 options=('libtool')
diff --git a/mingw-w64-xerces-c/PKGBUILD b/mingw-w64-xerces-c/PKGBUILD
index b141f0a21d..7e9445b1e8 100644
--- a/mingw-w64-xerces-c/PKGBUILD
+++ b/mingw-w64-xerces-c/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A validating XML parser written in a portable subset of C++ (mingw-w64)
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://xerces.apache.org/xerces-c"
+msys2_references=(
+  "cpe: cpe:/a:apache:xerces-c%2b%2b"
+)
 license=('spdx:Apache-2.0')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-autotools")
diff --git a/mingw-w64-xmlsec/PKGBUILD b/mingw-w64-xmlsec/PKGBUILD
index 90c49bbd61..01bb116521 100644
--- a/mingw-w64-xmlsec/PKGBUILD
+++ b/mingw-w64-xmlsec/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="XML Security Library is a C library based on LibXML2 (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.aleksey.com/xmlsec/"
+msys2_references=(
+  "cpe: cpe:/a:xmlsec_project:xmlsec"
+)
 license=('spdx:MIT')
 depends=("${MINGW_PACKAGE_PREFIX}-libxml2"
          "${MINGW_PACKAGE_PREFIX}-libxslt"
diff --git a/mingw-w64-xpdf/PKGBUILD b/mingw-w64-xpdf/PKGBUILD
index d23363df28..2801431417 100644
--- a/mingw-w64-xpdf/PKGBUILD
+++ b/mingw-w64-xpdf/PKGBUILD
@@ -10,7 +10,9 @@ arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://www.xpdfreader.com/"
 msys2_references=(
-  'cpe: cpe:/a:xpdf:xpdf'
+  "cpe: cpe:/a:xpdf:xpdf"
+  "cpe: cpe:/a:xpdf_project:xpdf"
+  "cpe: cpe:/a:xpdfreader:xpdf"
 )
 license=('spdx:GPL-2.0-only OR GPL-3.0-only')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-xz/PKGBUILD b/mingw-w64-xz/PKGBUILD
index 03462dfa42..d2d4aa867c 100644
--- a/mingw-w64-xz/PKGBUILD
+++ b/mingw-w64-xz/PKGBUILD
@@ -13,6 +13,7 @@ url="https://tukaani.org/xz"
 msys2_repository_url="https://github.com/tukaani-project/xz/"
 msys2_references=(
   'archlinux: xz'
+  "cpe: cpe:/a:tukaani:xz"
 )
 # TODO: check situation with getopt_long mentioned in COPYING for possible
 # removal of LGPL from this field
diff --git a/mingw-w64-yaml-cpp/PKGBUILD b/mingw-w64-yaml-cpp/PKGBUILD
index 9bbd79f29d..a6df7e42f4 100644
--- a/mingw-w64-yaml-cpp/PKGBUILD
+++ b/mingw-w64-yaml-cpp/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="A YAML parser and emitter in C++ matching the YAML 1.2 spec (mingw-w64)
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64' 'clangarm64')
 url="https://github.com/jbeder/yaml-cpp"
+msys2_references=(
+  "cpe: cpe:/a:yaml-cpp_project:yaml-cpp"
+)
 license=("spdx:MIT")
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-yarn/PKGBUILD b/mingw-w64-yarn/PKGBUILD
index 6c92f7956d..5ed5e30c1e 100644
--- a/mingw-w64-yarn/PKGBUILD
+++ b/mingw-w64-yarn/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Fast, reliable, and secure dependency management (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw64' 'ucrt64' 'clang64')
 url="https://yarnpkg.com/"
+msys2_references=(
+  "cpe: cpe:/a:yarnpkg:yarn"
+)
 license=("spdx:BSD-2-Clause")
 depends=("${MINGW_PACKAGE_PREFIX}-nodejs")
 source=("https://github.com/yarnpkg/${_realname}/releases/download/v${pkgver}/${_realname}-v${pkgver}.tar.gz"
diff --git a/mingw-w64-yasm/PKGBUILD b/mingw-w64-yasm/PKGBUILD
index c37ca7800b..b72cc14ca2 100644
--- a/mingw-w64-yasm/PKGBUILD
+++ b/mingw-w64-yasm/PKGBUILD
@@ -10,6 +10,10 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clangarm64' 'clang32')
 license=('BSD' 'GPL2' 'LGPL2.1' 'PerlArtistic')
 url="https://www.tortall.net/projects/yasm/"
+msys2_references=(
+  "cpe: cpe:/a:tortall:yasm"
+  "cpe: cpe:/a:yasm_project:yasm"
+)
 depends=("${MINGW_PACKAGE_PREFIX}-gettext-runtime")
 options=('strip' '!libtool' 'staticlibs')
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-zbar/PKGBUILD b/mingw-w64-zbar/PKGBUILD
index a1865ca614..9f86dcd582 100644
--- a/mingw-w64-zbar/PKGBUILD
+++ b/mingw-w64-zbar/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Application and library for reading bar codes from various sources (min
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://github.com/mchehab/zbar"
+msys2_references=(
+  "cpe: cpe:/a:zbar_project:zbar"
+)
 license=('spdx:LGPL-2.1-or-later')
 depends=("${MINGW_PACKAGE_PREFIX}-libiconv"
          "${MINGW_PACKAGE_PREFIX}-gettext-runtime"
diff --git a/mingw-w64-zeromq/PKGBUILD b/mingw-w64-zeromq/PKGBUILD
index 9eeb0ffd03..a5f9d8f8ec 100644
--- a/mingw-w64-zeromq/PKGBUILD
+++ b/mingw-w64-zeromq/PKGBUILD
@@ -10,6 +10,10 @@ arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://www.zeromq.org/"
 msys2_repository_url="https://github.com/zeromq/libzmq/"
+msys2_references=(
+  "cpe: cpe:/a:zeromq:libzmq"
+  "cpe: cpe:/a:zeromq:zeromq"
+)
 license=("spdx:MPL-2.0")
 depends=("${MINGW_PACKAGE_PREFIX}-libsodium"
          "${MINGW_PACKAGE_PREFIX}-libwinpthread-git")
diff --git a/mingw-w64-zlib/PKGBUILD b/mingw-w64-zlib/PKGBUILD
index 23dbab015a..d12c6cb989 100644
--- a/mingw-w64-zlib/PKGBUILD
+++ b/mingw-w64-zlib/PKGBUILD
@@ -14,6 +14,10 @@ mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 license=('spdx:Zlib')
 url="https://www.zlib.net/"
 msys2_repository_url="https://github.com/madler/zlib"
+msys2_references=(
+  "cpe: cpe:/a:gnu:zlib"
+  "cpe: cpe:/a:zlib:zlib"
+)
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
              "${MINGW_PACKAGE_PREFIX}-autotools"
              "${MINGW_PACKAGE_PREFIX}-bzip2")
diff --git a/mingw-w64-zstd/PKGBUILD b/mingw-w64-zstd/PKGBUILD
index ec346efb18..468deabfcc 100644
--- a/mingw-w64-zstd/PKGBUILD
+++ b/mingw-w64-zstd/PKGBUILD
@@ -9,6 +9,9 @@ pkgdesc="Zstandard - Fast real-time compression algorithm (mingw-w64)"
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url='https://facebook.github.io/zstd/'
+msys2_references=(
+  "cpe: cpe:/a:facebook:zstandard"
+)
 license=('BSD')
 depends=("${MINGW_PACKAGE_PREFIX}-gcc-libs")
 makedepends=("${MINGW_PACKAGE_PREFIX}-cc"
diff --git a/mingw-w64-zziplib/PKGBUILD b/mingw-w64-zziplib/PKGBUILD
index 32497bc2dc..2cd4992c2e 100644
--- a/mingw-w64-zziplib/PKGBUILD
+++ b/mingw-w64-zziplib/PKGBUILD
@@ -9,6 +9,10 @@ pkgdesc="A lightweight library that offers the ability to easily extract data fr
 arch=('any')
 mingw_arch=('mingw32' 'mingw64' 'ucrt64' 'clang64' 'clang32' 'clangarm64')
 url="https://zziplib.sourceforge.net/"
+msys2_references=(
+  "cpe: cpe:/a:zziplib:zziplib"
+  "cpe: cpe:/a:zziplib_project:zziplib"
+)
 license=("LGPL, MPL")
 makedepends=("${MINGW_PACKAGE_PREFIX}-pkgconf"
              "${MINGW_PACKAGE_PREFIX}-python"