Vulnrichment Playground

on YouTube ↗35m

" summary

CISA’s Vulnrichment ADP is delivering machine-readable SSVC, KEV, CVSS and CWE data and is actively experimenting with new fields and policies under “Year 2.” The program stopped adding CPEs after analysts reported CPEs consume ~2/3 of analysis time, and now enriches every new CVE (backfilled from early 2024). A Pandoc CVE shows the workflow: CVSS/SSVC added, references corrected, description rewritten, and public GitHub issues track disputes; exploration continues for CVE relationships and a Supplier ADP flag.

AI-written summary · about

" chapters (6)

1. 0:00CISA vulnerability response
2. 6:01Venrichment purpose
3. 10:08Venrichment in production
4. 14:07Pandoc CVE case study
5. 21:12Venrichment future directions
6. 25:03Q&A on Venrichment

" related talks

• 30mVulnrichment: Year OneArt Manion, Lindsey Cerkovnik · CVE/FIRST VulnCon 2025
• 32mOperationalizing SSVCLindsey Cerkovnik, Sean Letona · CVE/FIRST VulnCon 2025
• 30mThe National Vulnerability Database (NVD) – Where It Is and Where It’s GoingMatthew Scholl, Tanya Brewer · CVE/FIRST VulnCon 2025
• 38mThe Enriched CVE Record: Redefining Completeness and Quality for Greater ImpactAlec Summers · CVE/FIRST VulnCon 2025
• 26mWhere Do We Aim? A Look at the State of Vulnerable Software Identification and Its FutureAndrew Suter · CVE/FIRST VulnCon 2025
• 58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization StandardsYotam Perkal · CVE/FIRST VulnCon 2024 & Annual CNA Summit
• 29mThe Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting StandardsJerry Gamblin · CVE/FIRST VulnCon 2025
• 30mThe Growing Crisis in CVE Data QualityJerry Gamblin · BSidesSF 2025