What Should CVE Be When It Grows Up

The panel opened with the pressures on the CVE Program: funding worries after a contract delay earlier this year, a slowdown in NVD enrichment, and questions about governance, transparency and international participation. A representative of the sponsoring agency said the program remains funded and is treated as a public good, and described how the agency relies on CVE records for its own operations, such as tracking exploited flaws. Board members explained how the board is structured, with long-serving volunteers nominated by peers, and acknowledged that it could better reflect the global community of producers and consumers.

The discussion then turned to data quality. Panelists said that with NVD no longer adding enrichment such as CPE, CVSS scores and CWE mappings, the burden has shifted to CNAs, and that patch links and CPE appear in only a small share of published records. They described the program's move from a growth era, when the number of CNAs rose from about two dozen to over 460, to a quality focus on completeness, accuracy and timeliness. Comparisons with safety-regulated industries sparked debate over regulation, with some arguing that planned EU notification rules could make CVE the standard notification body.

The closing advice centered on consumer leverage: check whether records are complete, ask vendors for better data during contract renewals, brief policy teams, and join a forthcoming consumer working group. The main takeaway was that defenders can shape the program's next form by demanding better data and getting involved.