Mastodawn

BrianKrebs Apr 15, 2025

I boosted several posts about this already, but since people keep asking if I've seen it....

MITRE has announced that its funding for the Common Vulnerabilities and Exposures (CVE) program and related programs, including the Common Weakness Enumeration Program, will expire on April 16. The CVE database is critical for anyone doing vulnerability management or security research, and for a whole lot of other uses. There isn't really anyone else left who does this, and it's typically been work that is paid for and supported by the US government, which is a major consumer of this information, btw.

I reached out to MITRE, and they confirmed it is for real. Here is the contract, which is through the Department of Homeland Security, and has been renewed annually on the 16th or 17th of April.

https://www.usaspending.gov/award/CONT_AWD_70RCSJ23FR0000015_7001_70RSAT20D00000001_7001

MITRE's CVE database is likely going offline tomorrow. They have told me that for now, historical CVE records will be available at GitHub, https://github.com/CVEProject

Yosry Barsoum, vice president and director at MITRE's Center for Securing the Homeland, said:

“On Wednesday, April 16, 2025, funding for MITRE to develop, operate, and modernize the Common Vulnerabilities and Exposures (CVE®) Program and related programs, such as the Common Weakness Enumeration (CWE™) Program, will expire. The government continues to make considerable efforts to support MITRE’s role in the program and MITRE remains committed to CVE as a global resource.”

USAspending.gov

Show thread

BrianKrebs

UPDATE: The CVE board today announced the creation of non-profit entity called The CVE Foundation that will continue the program's work under a new, unspecified funding mechanism and organizational structure.

"Since its inception, the CVE Program has operated as a U.S. government-funded initiative, with oversight and management provided under contract," the press release reads. "While this structure has supported the program's growth, it has also raised longstanding concerns among members of the CVE Board about the sustainability and neutrality of a globally relied-upon resource being tied to a single government sponsor."

The organization's website, thecvefoundation.org, is less than a day old and currently hosts no content. The announcement said the foundation would release more information about its structure and transition planning in the coming days.

Show thread

BrianKrebs Apr 16, 2025

And, just like that there IS content on the foundation's site.

Show thread

mc.fly Apr 16, 2025

@briankrebs I see this but i am sceptical.
Something funded by likely the same industry that has security issues announced over themself will have trust questions.

I think the more relevant point in here is that the EUVD was started today - with solid funding, carried by a group of countries.

https://euvd.enisa.europa.eu/

This is likely the better successor for CVE

EUVD

European Vulnerability Database