This Internet-Draft describes the Vulnerability Data Model (VDM) version 1.0, a vendor neutral data model for expressing data and metadata for individual vulnerabilities, and an XML format that can be used to exchange vulnerability data model information. VDM provides standard fields, formats and vocabularies that can be used to transmit information about software vulnerabilities between entities in an interoperable manner. VDM is suited for a wide variety of use cases, and provides extension points to facilitate additional use cases.