Future of CVE
Talkat Global Security Vulnerability Summit @ Open Source Summit North America 2022 · on Thursday, 2022-06-23· at 16:55· Brazos (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
CVE is moving from a GitHub pilot to proper API submission and self-managed CNAs, adds a JSON5 with containers format so multiple data providers can contribute distinct content, and plans an official announcement June 30 while still rolling out services. Current counts show ~220 CNAs but CVE totals trail other databases by thousands; coverage, duplication, cloud-service scoping, and transparency remain unresolved. Workarounds include VEX and SBOM integration and pressure from DWf/GSD to speed modernization.
AI-written summary · about
chapters (10)
- 0:00Start
- 2:12The Future of Cve
- 3:57Coordinated Disclosure
- 4:58Cve Numbering Authority
- 7:48Id Reservation System
- 14:26Hierarchy to the Cnas
- 17:27The Global Security Database
- 20:33Containers
- 23:32Mission Focus
- 43:25Gsd Global Security Database
related talks
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
53mCNA Feedback Session to the CVE Program
37mGoverning Global Vulnerabilities: Standards for Open Source Resilience
56mCISA’s North Star Vision for the CVE Program
51mCNA Birds of a Feather: Open Forum with Certified Numbering Authorities
01h 00mCVE Records: The Cybersecurity Glow-Up You Didn’t Know You Needed
38mThe Enriched CVE Record: Redefining Completeness and Quality for Greater Impact
57mThe CWE Program: Current State and Road Ahead