CVE Record Format - Past, Present, and Future
summary
CVE Record Format is currently at v5.1.1 with work headed toward v5.1.2, having added CVSS4 and a usable CPE applicability block; the repo shows PRs to tighten affected-array validation, add semver validation for version types, and document purl/other software identifiers. Plans include SSVC support, consumer-focused working groups, phased deprecation of obsolete fields, and stronger automated checks via CVE Services—changes land incrementally to avoid breaking existing records.
AI-written summary · about
chapters (18)
- 0:00CVE record format intro
- 1:05What is CVE record format
- 3:12Why CVE record format matters
- 5:41Recent CVE format updates
- 8:52Improving CPE data in CVE
- 11:23Tighter schema validation 5.1.2
- 13:50SEVer version validation
- 15:59Future version type support
- 18:31Supporting Pearl in CVE
- 20:42Stakeholder vulnerability classification
- 22:44Removing obsolete schema props
- 26:14Contributing to CVE schema
- 26:56CalVer and Pearl questions
- 29:03Join CVE Quality Working Group
- 31:11Expanding ADP program access
- 36:13Narrative fields and data quality
- 41:47CVE records and VEX integration
- 43:15ADP validation and scope
related talks
46mCVE Record Format - Purl and CPE Workshop
45mFuture of CVE
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
33mCVE Decaf: Brewing Better and More Actionable Data Quality
01h 16mCVSS SIG Past, Present & Future + CVSS v4.0 Beyond the Numbers
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
35mVulnrichment Playground
30mThe Growing Crisis in CVE Data Quality