It’s impressive that the number of CVEs issued the last two years has skyrocketed, given how badly DOGE gutted the cybersecurity [0] agencies. Unfortunately we don’t know how huge the backlog may have since grown
[0] https://www.securityweek.com/mitre-signals-potential-cve-pro...
DOGE was impressively criminal. The team tried to remove the CVE reporting system entirely and only failed to do so because of intevention from the military and several agencies.
> DOGE was impressively criminal. The team tried to remove the CVE reporting system
Honest question: what would be the criminal purpose for that?
I think the argument would just be, “why should the government do this when someone else could be making money off it”
Two points on that:
1) the government is currently doing the work and the work is critical. Yoinking the system without any replacement causes catastrophic consequences that reduce profits (and maybe get a few folks killed, but really, think of the bottom line.) Anyways, if you want to transition a critical component you do so with a plan.
2) It is critically necessary for the CVE system to be trusted by many entities worldwide. The government has historically not played favorites and had that trust. This is still mostly true. No for-profit commercial entity has that same level of trust; the for-profit model removes the ability for that trust to truly be universal.
Sabotage the government to further the interests of their employer
Watch the world burn.
State sponsored sabotage.
[dead]
[dead]
gov contractors will always whine when funding gets cut. And then things work the same or better after the cuts. Such is life.
Do the agencies do any research to find CVEs? Or do they run a mostly cacheable website where they simply get posted?
The CVE system is far, far from perfect and NIST has faced increasing criticism (even before 2025) about its ability to triage and process the backlog. But I don't think their role is limited to simply posting what’s sent to them?
https://www.securityweek.com/cve-and-nvd-a-weak-and-fracture...
They have nothing to do with the number is my point. They don't uncover anything.
"They"? MITRE runs cve.org under contract by CISA.
The name is amusingly often misunderstood in Germany as a French government agency (this is anecdata, I‘ve just heard that several times in the last few months). It just sounds French, I guess.
But they don’t research, validate, or PoC anything. It’s a just a centralized place to issue unique ids and eventually publish a bunch of text.