diff --git a/mysqltuner.pl b/mysqltuner.pl
index f5342cb3a..17175878f 100755
--- a/mysqltuner.pl
+++ b/mysqltuner.pl
@@ -753,7 +753,7 @@ sub setup_environment {
     $opt{pass} = $opt{password}
       if ( !$opt{pass} and $opt{password} );
 
-    # for RPM distributions
+    # for downstream distributions
     $basic_password_files = "/usr/share/mysqltuner/basic_passwords.txt"
       unless -f "$basic_password_files";
 
@@ -777,6 +777,10 @@ sub setup_environment {
     $opt{cvefile} = './vulnerabilities.csv'
       if ( !$opt{cvefile} && -f './vulnerabilities.csv' );
 
+    # for downstream distributions
+    $opt{cvefile} = '/usr/share/mysqltuner/vulnerabilities.csv'
+      if ( !$opt{cvefile} && -f '/usr/share/mysqltuner/vulnerabilities.csv' );
+
     $opt{'bannedports'} = '' unless $opt{'bannedports'};
     @banned_ports       = split ',', $opt{'bannedports'};