Towards a Minimum Viable Enumeration of Vulnerabilities

on YouTube ↗28m

" summary

Proposal claims the absolute MVVE is just two fields: a unique public identifier and a product identifier including version/build, enough to initiate discovery and disambiguate instances; without both, vulnerability management halts. Authors map that MVVE to CVE, OSV and other databases, sketch an 11‑phase lifecycle and four stakeholder roles, and publish slides plus a paper. An “MVVE++” adds a required remediation intent field so prioritization and response can proceed.

AI-written summary · about

" chapters (10)

1. 0:00Welcome to MVVE
2. 1:49Origin and purpose
3. 5:03Core elements of MVVE
4. 8:54Vulnerability phases and roles
5. 14:13Real-world complexity
6. 17:21Information elements list
7. 19:27Identifying vulnerability
8. 22:37Minimum required fields
9. 23:37MVE plus introduction
10. 26:49Future work

" related talks

• 37mThe Vulnerability Identity CrisisArt Manion, Jay Jacobs · FIRST Conference 2026 (FIRSTCON26)
• 57mA Paradigm Shift in Vulnerability Identity: Why Vulnerability Databases StruggleArt Manion, Jay Jacobs · CVE/FIRST VulnCon 2026 & Annual CNA Summit
• 45mVulntology - A Methodology to Characterize Vulnerabilities While Providing A Granular & Intuitive...Christopher Turner · Global Security Vulnerability Summit @ Open Source Summit North America 2022
• 27mEffective Vulnerability Management for a DevSecOps PipelineNikki Robinson · DevOpsDays Washington, D.C. 2024
• 37mPrioritizing Vulnerability Response with a Stakeholder Specific Vulnerability CategorizationJonathan M. Spring · 34th Annual FIRST Conference 2022
• 15mA vulnerability database should not be about vulnerabilities!Hrithik Vijay · IndiaFOSS 3.0
• 32mUnderstanding Exploitability with VEX, EPSS, and Other Standard FrameworksAyse Kaya · GitOpsCon North America 2024
• 58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization StandardsYotam Perkal · CVE/FIRST VulnCon 2024 & Annual CNA Summit