#CVE Foundation just dropped a FAQ.

https://www.thecvefoundation.org/frequently-asked-questions

Also, just FYI, I’ve been helping with the Foundation setup and goals articulation and logistics for the last few weeks. I didn’t expect we’d pull the trigger on being public this week, precisely, but here we are!

I’m not employed there or anything (I work at @runZeroInc) but since I care about CVE, I want to do what I can to make sure it thrives and we don’t wind up back again with 15 competing standards for #vulnerability tracking if USG funding goes poof! one day (or other single-source-funding style disasters).

Anyway, back to my ill-timed family vacation. I’ll be more online next week. :)

As part of the 2022 EU NIS2 directive, the EU agency for cybersecurity (ENISA) has been setting up the EU Vulnerability Database (EUVD) at https://euvd.enisa.europa.eu/ (now in beta).

Started as a collaboration with MITRE's authoritative CVE database, EUVD may now end up replacing it, as US funding for the CVE database has stopped.

in letzter Sekunde gerettet: US-Cybersicherheitsbehörde CISA hat den Betrieb der CVE-Datenbank (Liste aller gemeldeten IT-Sicherheitslücken) für die nächsten 11 Monate sichergestellt; Alternativen von EU und Luxemburg ...

#cve #itsecurity #dpsvd33uus25

https://www.heise.de/news/Nach-drohendem-CVE-Aus-Schwachstellendatenbank-der-EU-geht-an-den-Start-10354324.html#google_vignette

#Mitre #cybersecurity #Trump Das Ende für #CVE ...

Windows NTLM flaw (CVE-2025-24054) is under active exploitation! Learn how this critical vulnerability impacts your security and what you can do to stay safe.

#CyberSecurity #InfoSec #ThreatIntel #Vulnerability #WindowsSecurity #CVE #ZeroDay #SecurityNews

Learn more: https://zerodaily.me/blog/2025-04-18-windows-ntlm-cve-2025-24054-under-active-exploitation

'Stupid and Dangerous': #CISA Funding Chaos Threatens Essential #Cybersecurity Program

The #CVE Program is the primary way software #vulnerabilities are tracked. Its long-term future remains in limbo even after a last-minute renewal of the US government contract that funds it.

https://www.wired.com/story/cve-program-cisa-funding-chaos/

Moving CVEs past one-nation control – Source: news.sophos.com https://ciso2ciso.com/moving-cves-past-one-nation-control-source-news-sophos-com/ #rssfeedpostgeneratorecho #SecurityOperations #CyberSecurityNews #ThreatResearch #nakedsecurity #nakedsecurity #FEATURED #featured #MITRE #CVE

The US government has decided to continue funding the Common Vulnerabilities and Exposures (CVE) program, crucial for tracking cybersecurity weaknesses. This move by CISA aims to enhance national security. How do you think this will impact vulnerability management? #cybersecurity #CVE

Read more: https://short.steelefortress.com/m8clej

Cybersicherheit: USA stellen Finanzierung des CVE-Programms ein (Update) https://www.computerbase.de/news/wirtschaft/cybersicherheit-usa-stellen-finanzierung-des-cve-programms-ein.92215/#update-2025-04-17T17:41 #cve #cybersicherheit

Saved at the final hour!

Security Database Used by Apple Goes Independent After Funding Cut [Updated]

https://www.macrumors.com/2025/04/16/security-database-used-apple-goes-independent/

#CISA extends funding to ensure 'no lapse in critical #CVE services'

https://www.bleepingcomputer.com/news/security/cisa-extends-funding-to-ensure-no-lapse-in-critical-cve-services/

The US Cybersecurity and Infrastructure Security Agency (CISA) has moved to secure continued operations of the Common Vulnerabilities and Exposures (CVE) programme by extending its contract with MITRE, preventing a potentially disruptive lapse in critical cybersecurity services.

https://www.computing.co.uk/news/2025/security/cisa-extends-mitre-s-bug-tracking-funding-for-now

CISA extends MITRE-backed #CVE contract hours before its lapse

The Cybersecurity and Infrastructure Security Agency extended its contract for the MITRE-backed Common Vulnerabilities and Exposures Program late Tuesday night
https://www.nextgov.com/cybersecurity/2025/04/cisa-extends-mitre-backed-cve-contract-hours-its-lapse/404601/?oref=ng-homepage-river

We're taking a first step to mitigate future damage from the irreparably broken, and IRL harmful legacy #CVE system by adding EUVD (https://euvd.enisa.europa.eu/) references to all formerly CVE-based tags.

I hope ENISA becomes a GCVE (https://gcve.eu/) CNA, soon, and starts to transition to a more stable vulnerability reference system/standard, free from U.S. government ineptness and vendor biases.

Gonna try to get all the EUVD URL refs added while y'all are boozing it up at RSA next week.

After the #MITRE #CVE DB funding scare of a couple of days, it seems that the problem is apparently solved, for now: https://www.bleepingcomputer.com/news/security/cisa-extends-funding-to-ensure-no-lapse-in-critical-cve-services/

Critical vulnerability found in Erlang/OTP SSH server

https://nvd.nist.gov/vuln/detail/CVE-2025-32433

Five GNA register to Global CVE (GCVE) allocation system vuldb.com, Ericsson PSIRT, EACG, SCHUTZWERK and DFN-CERT.

If you want to join and get a unique identifier
https://gcve.eu/about/#eligibility-and-process-to-obtain-a-gna-id

RGB software is unfortunately based on unsupported and disavowed software.

Yes, the XKCD cartoon is referenced.

#rgb #software #MicrosoftDefender #CVE

https://youtu.be/H_O5JtBqODA