The Growing Crisis in CVE Data Quality
summary
CVE records grow fast and many are low quality: 30% more CVEs year‑over‑year and 291,000 CVEs in NVD with roughly 24,000 lacking CVSS/CPE/CWE and about 20% missing product fields. Government funding runs through layered contracts (MITRE ~$29M, NIST contractor ~$125M/5yr) equating to roughly $1,237 per new CVE, yet NVD cannot keep up enrichment. Proposed fixes: mandatory CVSS/CPE/CWE, machine validation/AI enrichment, stronger CNA data requirements, and consolidation of overlapping public databases.
AI-written summary · about
chapters (10)
- 0:00Introduction and welcome
- 1:03CVE funding crisis revealed
- 3:51CVE system bureaucracy explained
- 6:22CVE growth and data quality issues
- 7:44Minimal CVE publishing requirements
- 10:31NVD funding and data backlog
- 12:59Government funding and mandates
- 16:51Privatization and globalization of CVEs
- 18:38Proposed solutions for CVE quality
- 21:54Q&A session begins
related talks
29mThe Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting Standards
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
41mNIST’s National Vulnerability Database Update and the Vulnerability Enrichment Ecosystem
38mThe Enriched CVE Record: Redefining Completeness and Quality for Greater Impact
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
30mVulnrichment: Year One
01h 00mCVE Records: The Cybersecurity Glow-Up You Didn’t Know You Needed
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm