CVE Records: The Cybersecurity Glow-Up You Didn’t Know You Needed
summary
CISA reports 284 CNAs created ~23,000 CVE records last year with ~12,000 including both CWE and CVSS (71% CWE, 53% CVSS); CISA itself onboarded 40+ orgs recently and as a Root added 50+ CNAs since 2020. CISA performs vuln enrichment (adds CWE/CVSS, first three SSVC decision points, KEV flags), exposes bulk JSON downloads and a GitHub feedback loop, and cites tools like CNA Guru for automating CWE/CVSS assignment. Between Sep 1, 2024 and Apr 1, 2025 one CISA root published 569 CVEs with 95% CWE and 64% CVSS.
AI-written summary · about
chapters (10)
- 0:00CVE Records introduction
- 5:59CISA’s role in vulnerability management
- 7:06Why CVE records matter
- 11:42What is a CVE record
- 22:48Why CWE enrichment matters
- 33:04Importance of CVSS scoring
- 41:15How CISA enhances CVE records
- 48:18Coaching CNAs for better records
- 50:38Call to action for enriched CVE records
- 52:24Q&A
related talks
30mThe Growing Crisis in CVE Data Quality
57mThe CWE Program: Current State and Road Ahead
45mFuture of CVE
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
01h 05mWhat It Takes to Lead America’s Vulnerability Management Team
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
48mCISA-ENISA Joint Messaging
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience