CVE/FIRST VulnCon 2026 & Annual CNA Summit
2026-04-13..2026-04-16
Scottsdale, United States
[CVE/FIRST VulnCon 2024 & Annual CNA Summit, CVE/FIRST VulnCon 2025, CVE/FIRST VulnCon 2026 & Annual CNA Summit]
as the organisers put it
Save the Date: CVE/FIRST VulnCon 2026 & Annual CNA Summit - Scottsdale (US), April 13–16, 2026
who it's for
CNA administrators, vulnerability analysts, product security engineers, security program managers, SBOM engineers, open source maintainers, threat intelligence analysts
topics
CVE record format and purl; CSAF and VEX automation; SBOM interpretation tools; contextual build-time SBOMs; automating CNA CVE reporting; vulnerability matching and mapping; post-quantum crypto migration; dependency provenance in compiled binaries; reproducible CVSS/SSVC scoring; CISA KEV and exploited CVEs; AI agents for triage and enrichment; supply chain and vendor bias analysis
| title | author | length |
|---|---|---|
| NIST’s National Vulnerability Database Update and the Vulnerability Enrichment Ecosystem | Harold Booth | 41m |
NVD reports 502 CNAs and a CVE backlog so large that everything before March 1, 2026 moves to a new not scheduled status; KEV-listed CVEs get enrichment within… | ||
| Lessons From NPM's Dark Side: Preventing the Next Shai-Hulud | Jenn Gile | 53m |
NPM advisories spike 20x in 2025 with account takeover events up 12x; attackers compromise popular packages (eslint-config-prettier: 38.1M weekly downloads… | ||
| Three Musketeers: CVE, CSAF, and VEX | Eoin Wilson-Manion, Tyler Zellers, Jonathan M. Spring | 46m |
CISA and partner teams build a custom platform that ingests vendor reports, uses Vulnogram and SecVizigram prototypes for validation, and outputs paired CVE… | ||
| Panel: CVE Record Disputes Discussion: Policy, Process, and Opportunities for Improvement | Alec Summers, Yogesh Mittal, Lisa Olson, Lindsey Cerkovnik, Jimmy Calderon | 54m |
Panel explains why CVE records get an explicit disputed tag and how the policy enforces a 3-day acknowledgement / 5-day decision timeline with escalation after… | ||
| Mind the Match: Why Vulnerability Matching Is Harder Than You Think | Alexandra Selldorff | 21m |
Scanning the same Red Hat 8 image returns 852 vs 3,719 findings because different tools and SBOM metadata choices disagree — experiments show 80.5% divergence… | ||
| How to Answer “What’s Affected?” in Open Source | Jess Lowe, Rex Pan | 25m |
OSV converts messy CVE data into precise artifact-level ranges by adding Git-aware semantics to its minimal schema: version events… | ||
| Preparing Vulnerability Management for the Post-Quantum Era: From Legacy Cryptography Crypto-Agility | Arun Singh | 30m |
ZoomEye and Qualys VMDR data show legacy crypto at scale: 19.3 million RSA‑1024 assets, 8.6M TLS 1.0 and 2.24M TLS 1.1, and internal detections flagging TLS1.0… | ||
| Flipping the Criticality Funnel, A Practical Path to Real Prioritization | Sophia Sanles-Luksetich, Zachary Goldman | 27m |
GitHub describes flipping an inverted risk funnel by building a unified risk score that normalizes findings from 20+ sources and ~200,000 new findings/day… | ||
| The CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data | Lindsey Cerkovnik, Alec Summers | 01h 00m |
The CVE Program announces a “Quality Era” that pushes beyond ID/description/references toward required metadata, automation, and governance changes: updated… | ||
| From JSON to Clarity: Practical Tools for SBOM Interpretation | John Bergland, Zadia Alden | 44m |
Five lightweight web apps convert raw CycloneDX/SPDX JSON into actionable views: a drag-and-drop HTML tool that flags duplicate bomRefs, generic PURLs and… | ||
| Contextual SBOMs: Unlocking Precise Vulnerability Management with Build-Time Content Intelligence | Przemysław Roguski | 36m |
Traditional flat SBOMs leave teams guessing where vulnerabilities come from; Contextual SBOMs map every artifact to the build step that introduced it using… | ||
| Vulnrichment Playground | Art Manion, Lindsey Cerkovnik | 35m |
CISA’s Vulnrichment ADP is delivering machine-readable SSVC, KEV, CVSS and CWE data and is actively experimenting with new fields and policies under “Year 2.”… | ||
| CVE Record Format - Purl and CPE Workshop | Chris Coffin | 46m |
CVE Record Format 5.2.0 adds PURL support while 5.1.1 added CPE; PURLs are represented as the package URL object in the CVE JSON and must omit the version… | ||
| Operationalizing AIBOMs: Extending Vulnerability Management to AI Models and Datasets | Alexandra Selldorff, Ugur Koc | 31m |
Claims a practical way to treat models and datasets as first-class assets by producing machine-readable AIBOMs (an SBOM extended for AI) and running… | ||
| Identifying Exploited and Likely-to-Be-Exploited Vulnerabilities | Patrick Garrity, Wade Sparks | 30m |
VulnCheck describes a workflow that finds exploited or likely-to-be-exploited bugs lacking CVEs by correlating live evidence, exploit code, vendor advisories… | ||
| The Dependency Mirage: Hidden Vulnerabilities in Your Compiled Binaries | Craig Heffner, Peter Eacmen | 35m |
Compiled binaries routinely contain 47 hidden components including 14 statically linked libraries, 3 vendored libs, 30 build‑time injections that SBOMs and… | ||
| Automating CNA CVE Reporting and Monthly Bulletins | Deepak Chintala, Zachary Echouafni | 51m |
Atlassian automates CNA CVE reporting by building an automated CNA pipeline on Jira/Confluence/Forge that calls the MITRE CVE Services API, reserves CVE… | ||
| Stepping up the ENISA's role in Support of EU Vulnerability Services | Johannes Kaspar Clos | 32m |
ENISA describes building an operational EU vulnerability backbone: an EU Vulnerability Database launched April last year, onboarding CNAs after becoming a root… | ||
| Embracing the Era of Transparency: Automating VEX Application for Scalable, Context-Aware Security | Jessica Butler, Kristina Joos | 24m |
NVIDIA builds an automated VEX pipeline that scans container images, applies rule engines (parent image inheritance, vendor overlays, and manual review… | ||
| The Vulnerability Ecosystem’s Vendor Bias — Exposed by Open Source | Pete Allor, Yogesh Mittal | 27m |
Argues that the vulnerability model built for funded vendors collapses for OSS: 40 million component versions with most maintained by single unpaid people, 88%… | ||
| Panel: The CVE Supplier ADP (SADP) Pilot: Am I Affected byUpstream? | Art Manion, Jeremy Daigneau, Lisa Olson, Yogesh Mittal | 53m |
CVE adds Supplier ADP (SADP) pilot containers to CVE records to publish VEX-like inherited vulnerability status, using the existing CVE-Services ADP endpoint… | ||
| The Hidden Cost of CVEs: Can CSAF and VEX Change the Equation? | Lisa Olson | 17m |
Estimate that a single Windows CVE can consume 200 million global human hours when scaled across organizations, and a recent Patch Tuesday hits ~120 Windows… | ||
| A Paradigm Shift in Vulnerability Identity: Why Vulnerability Databases Struggle | Art Manion, Jay Jacobs | 57m |
Argues for an identity-first redesign that replaces prose-heavy CVE records with small, machine-verifiable assertions; two years of weekly design work shows… | ||
| CVE Decaf: Brewing Better and More Actionable Data Quality | Jerry Gamblin, Jay Jacobs | 33m |
Introduces a practical Data Quality Assessment Framework that separates schema limits from how CNAs populate fields, classifying issues as population gap… | ||
| Axiomatic Events that Evolved Vulnerability Databases | Johnny Shaieb | 56m |
Narrative traces concrete pivots: the very first ARPANET login causes a first network buffer overflow that exposes design gaps; early Multics bulletins publish… | ||
| Supply Chains and Malware Campaigns: Is CVE the Right Way to Name the Game? | Art Manion, Caitlin Condon, David Welch, Shelby Cunningham | 01h 04m |
2025–2026 cases force a tradeoff: XZ utils backdoor (CVE‑2024‑3094) and TJ Actions (CVE‑2025‑30066) show a CVE ID speeds automated alerts and toolchain… | ||
| Fragile by Design: Large-Scale Evidence of Supply Chain Risk | Gary Schwartz | 29m |
Analysis of ~19,000 firmware and container assets across 380+ organizations finds 88% of artifacts contain vulnerabilities, 467 million total hits (~500k… | ||
| The Myth of the Meteoric Rise in Vulnerabilities | Scott Moore | 30m |
Argues that rising CVE counts are inflated by mass reporting of trivial clones rather than a real security collapse: analysis of SourceCodester shows 369… | ||
| AI Systems Are Software Systems | Jonathan M. Spring | 50m |
Argues AI systems are ordinary software with familiar vulnerability management: use SBOM and track models as libraries, adopt the NIST SSDF AI profile, and… | ||
| National CSIRT as a CVD Hub: Lessons from CERT.PL’s Vulnerability Coordination Cases | Michał Dondajewski | 45m |
CERT.PL describes acting as Poland’s CNA since August 2023, assigning CVEs and publishing over 160 CVE entries in 2025 (about double 2024) while introducing a… | ||
| Speeding Up Vulnerability Triage: Automating Context Retrieval with AI Agents | Jorge Gimenez | 50m |
Claim: triage is a context-aggregation problem, not detection. A single LM agent that pastes every data dump overruns the context window and hallucinates, so… | ||
| Deriving CVSS from Multi-Scenario Attack Graphs: A Reproducible, Auditable Scoring Method | Karel Knibbe, Ruben Bos | 31m |
Claims a reproducible, auditable method that builds attack graphs represented in JSON and graph-based JSON model to enumerate every delivery/exploitation path… | ||
| Diving into the CVSS Base Score Metrics - An Exploratory Analysis Bridging Product Security... | Kohei Taguchi, Takayuki Uchiyama, Yuichi Kikuchi | 29m |
Dataset includes 424 medium-rated IoT CVEs (2023–24) and ~2,000 security-testing issues (2022–24), correlated with traffic from a Panasonic IoT honeypot… | ||
| Accuracy Is Not Enough: Detecting Hidden Risk in CVE Impact Prediction | Keerthana Purushotham | 28m |
An applied evaluation showing accuracy hides high-risk failures and proposing confusion-matrix metrics that surface them by design. Uses real Amazon Linux CVE… | ||
| Taming the Scanner Storm: How VEX Brings Context to Vulnerability Data | Jessica Butler | 30m |
NVIDIA overlays vendor VEX onto container OS scan results to separate actionable fixes from unresolved or unaffected findings, using a two-stage VEX pipeline… | ||
| Organizational Context Matters: Security Control Effectiveness on Vulnerabilities for Prioritization | Ertugrul Yaprak, Mehmet Kiliç | 39m |
Claims that combining CVE data, adversary techniques and asset criticality yields usable prioritization, backed by a Picus dataset and tooling: a 30,000-action… | ||
| The Quality Era of CVE: A Blueprint for Global Software Safety | Bob Lord | 29m |
Argues for redesigning CVE around an outcome: reduce software danger by enforcing quality at record creation, not downstream. Shows a working prototype with a… | ||
| The AI Arms Race in Vulnerability Management, Who’s Winning? | Yotam Perkal | 39m |
AI cuts the median time from disclosure to exploitation to 4 hours median time-to-exploit and produces both noise and effective output: automated reports swamp… | ||
| Boosting Vulnerability Intelligence: How Accurate CWE Mappings Transform ML Model Performance | David Starobinski, Sevval Simsek, Varsha Athreya | 30m |
FixV2W uses knowledge graph embeddings (TransE) plus NVD–CWE hierarchy and remap trends to replace prohibited or discouraged CWE placeholders with ranked… | ||
| Quantifying Swiss Cheese, the Bayesian Way | Stephen Shaffer | 50m |
Builds a living Bayesian model that combines EPSS scores, asset inventories, control-effectiveness beta priors and breach‑and‑attack simulation telemetry to… | ||
| AI Is Writing Your Bug Reports. Can You Tell? | Khushali Dalal | 24m |
Three real case studies show AI is inflating intake volume and credibility: a report with a hallucinated CVE and self-contradictory auth claims; a genuine… | ||
| The Weaponization Gap: What 20 Million KEV Detections Reveal About Edge Remediation | Saeed Abbasi | 50m |
Qualys TRU analyzes 20 million KEV detection events (2021–2025), applies Kaplan‑Meier survival analysis to 197 KEV CVEs on edge devices, and finds median… | ||
| Saving Ourselves the ID Headache: How Purls Can Work for Models and Datasets | Daniel Bardenstein | 33m |
Argues for reusing package URLs to identify models and datasets so vulnerability workflows work now rather than inventing a new ID; shows concrete examples… | ||
| Remediation-Aware Reachability: Patching Containers, Prioritizing with Agentic-CTI, and Scaling... | Francesco Cipollone | 51m |
Platform-grade pipeline that fuses real-time evidence with prediction and reachability so teams act on what is burning now, not CVSS noise: an open feed called… | ||
| The CVE Blind Spot: Defeating "Hidden EOLs" and Repo Jacking with Engineering Triage & Code Diet | Kota Kanbe, Ryunosuke Tanai | 41m |
Routine release of a GitHub release leads to a rapid repo takeover by an autonomous agent (token exfiltration to full takeover in ~90 minutes, 178 releases… | ||
| Transforming Vulnerability Management with Advanced Dependency Knowledge Graphs | David Starobinski, Sevval Simsek | 31m |
VDGraph merges CycloneDX SBOMs and OSV scan outputs into a Neo4j knowledge graph that is queryable and complete, built from automation over 100+ Maven projects… | ||
| Production Is the New Attack Surface: Why Post-Deployment Endpoint Detection Is Now Critical | Tracy Ragan | 26m |
Claims that most risk appears after deployment and that organizations must add a post-deployment detection layer, backed by Ortelius’ Ortelius… | ||
| Vulnerabilities Without CVEs: Governing the Dark Matter of Internal and Unknown Software | Josh Skorich | 51m |
Argues that at least ~20% of production software lives outside CVE coverage and goes unnoticed, and shows a practical fix: use endpoint telemetry to surface… | ||
| From Roadmap to Results: Measuring CWE Adoption to Enable Prevention | Alec Summers, Steve Christey Coley | 01h 01m |
CWE reports measurable adoption: a public REST API and 75 new weakness diagrams support automation, the community-driven CDR has 191 submissions (102 still… | ||
| CISA-ENISA Joint Messaging | Lindsey Cerkovnik, Nuno Rodrigues Carvalho | 48m |
CISA affirms 25 years as CVE sponsor and runs the Known Exploited Vulnerabilities (KEV) catalog and SSVC work, handling thousands of coordinated disclosure… | ||
| nothing matches | ||