CVE Is The Worst Vulnerability Framework (Except For All The Others)
summary
Analysis of 25 years of CVE/CWE/CVSS data finds structural shifts, not steady truth: seven breakpoints in weekly CVE publication, a model projecting a median ~800 CVEs/month (upper ~1,850) by April 2026, and large jumps tied to the 2016–17 CNA expansion and CWE reclassification. Methods include segmented regression and generalized additive models to detect timing/magnitude changes; examples include ~19,000 Android TLS CVEs, 27,000 retroactive MITRE CNA edits, and the 2022-28958 false exploit that was later retracted. Recommendations: document data edits, expose change logs, and make records machine-readable for valid longitudinal analysis.
AI-written summary · about
chapters (17)
- 0:00CVE framework challenges
- 1:26Talk purpose and disclaimers
- 6:58CVE historical evolution
- 10:06CVE publication trends
- 15:50New vendors in CVE system
- 18:20CVE distribution by vendor
- 21:08CNA expansion and changes
- 22:54CVSS scoring evolution
- 24:40OWASP Top 10 changes
- 27:33Undocumented CVE changes
- 30:22MITRE CVE record updates
- 35:03KEV catalog sneaky updates
- 38:10CWE/CVSS assignment disputes
- 43:05Incentives in vulnerability assessments
- 46:37CVE framework vulnerabilities
- 49:03Flawed CVE case study
- 53:11Irregularities and recommendations
related talks
52mThe Evolution of CVEs, Vulnerability Management, and Hybrid Architectures
01mEvolution of CVEs and Vulnerability Management
39mCVE 101: The Unfolding Of A Zero Day Attack
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm
30mThe Myth of the Meteoric Rise in Vulnerabilities
30mThe Growing Crisis in CVE Data Quality
54mTowards Real World Cyber Risk (Panel)