Why the CVE database for tracking security flaws nearly went dark - and what happens next

Why the CVE database for tracking security flaws nearly went dark - and what happens next

Expired US government funding nearly disrupted this global security system. How can we prevent this from happening again in 11 months?

Online risks will escalate as CVE database gets defunded

After the U.S. government initially cut its funding of the CVE database, used to track security vulnerabilities in operating systems and software, CISA has said it will continue to be funded for another 11 months at least.

US funding running out for critical cyber-vulnerability database: manager

The defence and research-focused nonprofit MITRE Corporation says funding from the US government runs out on Wednesday for it to maintain a critical database of cyber-vulnerabilities used by security researchers and digital defenders the world over.

On Wednesday, the contract to finance the CVE database located at Mitre and threatened to expire, now seems to have secured funding for another year. CVE (Common Vulnerabilities and Exposures) is used worldwide to keep track of security gaps and how to deal with them.

What's happening with MITRE and the CVE program uncertainty

Yesterday's headlines have sent ripples through the cybersecurity and software supply chain communities: MITRE announced that U.S. government funding for the CVE (Common Vulnerabilities and Exposures) database was set to expire today. Overnight, the CVE Foundation emerged with a plan to maintain the program before the Critical Infrastructure and Security Agency (CISA) announced it has extended support for the program this morning. As the backbone

A crucial system behind Android security updates just lost its funding (Update: Funding restored)

Credit: Robert Triggs / Android Authority The US government has stopped funding the Common Vulnerabilities and Exposures (CVE) database, a standardized global system for identifying and tracking software vulnerabilities across platforms and devices, including Android. Without CVEs, Google’s monthly Android security bulletins may face delays, confusion, or reduced transparency. It’s unclear who, if anyone, will step in to maintain or replace the…