Government MITRE CVE Program Gets Last-Hour Funding Reprieve The US government's cybersecurity agency CISA has “executed the option period on the contract” to keep the vulnerability catalog operational. Ryan NaraineApril 16, 2025
Government MITRE Warns CVE Program Faces Disruption Amid US Funding Uncertainty MITRE warns of a deterioration of national vulnerability databases and advisories, slowed vendor reaction and limited response operations. Ryan NaraineApril 15, 2025
Vulnerabilities NIST Puts Pre-2018 CVEs on Back Burner as It Works to Clear Backlog NIST has marked pre-2018 CVEs in NVD as ‘Deferred’ and will no longer spend resources on enriching them. Ionut ArghireApril 7, 2025
Vulnerabilities Two CVEs, One Critical Flaw: Inside the CrushFTP Vulnerability Controversy Two CVEs now exist for an actively exploited CrushFTP vulnerability and much of the security industry is using the ‘wrong one’. Eduard KovacsApril 3, 2025
Government NIST Still Struggling to Clear Vulnerability Submissions Backlog in NVD The effects of the backlog are already being felt in vulnerability management circles where NVD data promises an enriched source of truth. Ryan NaraineMarch 24, 2025
Cloud Security Google Cloud to Assign CVEs to Critical Vulnerabilities Google Cloud will be assigning CVE identifiers to serious cloud vulnerabilities, even ones that don’t require patching. Eduard KovacsNovember 13, 2024
Government NIST Getting Outside Help for National Vulnerability Database NIST is receiving support to get the NVD and CVE processing back on track within the next few months. Eduard KovacsMay 30, 2024
Vulnerabilities CVE and NVD – A Weak and Fractured Source of Vulnerability Truth MITRE is unable to compile a list of all new vulnerabilities, and NIST is unable to subsequently, and consequently, provide an enriched database of... Kevin TownsendApril 3, 2024
Government US Gov Says Software Measurability is ‘Hardest Problem to Solve’ White House calls for the “timely, complete, and consistent” publication of CVE and CWE data to help solve the security metrics problem. Ryan NaraineFebruary 27, 2024