The Art of Concealment: CVE’s Challenge

The talk looks at the Common Vulnerabilities and Exposures program, which began in 1999 with a simple goal of giving each vulnerability a standard identifier and description. The speaker argues that the promise of a common, usable record has eroded as the number of organizations allowed to publish CVEs has grown past 460, each with its own conventions for what goes into a record.

The core of the argument is that a CVE record needs a few pieces to be useful to defenders: a weakness classification, an identifier for the affected product, a severity score, and a clear patch reference. Drawing on recent publishing data, the speaker notes that only a small share of new records carry a product identifier, while weakness and severity fields are far more common. Patch information is usually scattered among many references. The loss of NVD enrichment in 2024 exposed how much scanners and automation had depended on that data, and the schema validation for record descriptions is minimal.

To make these gaps measurable, the speaker introduced CNA Scorecard, an open source site that refreshes several times a day and counts which required fields each publishing organization fills in across recent records. The launch counts fields rather than judging content quality. The talk closes by asking vendors to treat complete vulnerability records as part of what customers pay for, and it points to upcoming EU publishing rules as a factor that could either raise or lower the bar.