<- Back to Insights
April 8, 2024
CVE and NVD - A Weak and Fractured Source of Vulnerability Truth
Summary
The article discusses the limitations and challenges facing the Common Vulnerabilities and Exposures (CVE) List and the National Vulnerability Database (NVD), which are no longer able to serve as a comprehensive and central source of vulnerability information. MITRE, which oversees the CVE system, struggles to list all new vulnerabilities, while NIST faces difficulties in enriching the NVD with all vulnerabilities due to resource constraints. This issue is exacerbated by the increasing volume and complexity of vulnerabilities, with a reported 20% annual increase in new vulnerabilities. The article highlights the implications of these challenges, including the presence of vulnerabilities without CVE numbers, the potential for false positives and negatives within the system, and the fragmentation of vulnerability information across multiple platforms. The situation calls for improved mechanisms for vulnerability reporting and management, a problem that NIST aims to address by forming a consortium to develop better tools and methods. Despite these efforts, there remains a need for a more unified and efficient approach to vulnerability management to ensure the security of digital infrastructure.
![]()
Explore Related Topics
