The Enriched CVE Record: Redefining Completeness and Quality for Greater Impact
summary
CVE records now include CNAs adding structured metadata like CVSS, CWE and CPE at disclosure, driven by an April 2024 enrichment initiative that produces a measurable surge in contributions and a bi-weekly Enrichment Recognition List published on the CVE site. The program reports roughly 250 CNAs on the ERL vs ~180 that published in the last year, notes tooling that lowered friction for enrichment, and claims faster, more accurate data reaches defenders sooner.
AI-written summary · about
chapters (12)
- 0:00Enriched CVE records intro
- 1:06CVE completeness since 1999
- 3:10Enrichment standards: CVSS, CWE, naming
- 7:07Federating CVE program scaling
- 8:31Structured CVE format for enrichment
- 10:41CNA enrichment initiative
- 12:06Impact of CNA enrichment
- 13:31Enrichment Recognition List criteria
- 15:57Benefits of enrichment at disclosure
- 17:19CVE federated hierarchy
- 19:02Future CVE enrichment directions
- 20:28Q&A
related talks
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
30mThe Growing Crisis in CVE Data Quality
45mFuture of CVE
35mVulnrichment Playground
33mCVE Decaf: Brewing Better and More Actionable Data Quality
41mNIST’s National Vulnerability Database Update and the Vulnerability Enrichment Ecosystem
29mThe Quality Era of CVE: A Blueprint for Global Software Safety
57mThe CWE Program: Current State and Road Ahead