Post

You might wonder why the graph started ticking up around ~2016. That’s when CVE began aggressively enrolling more CVE Numbering Authorities! CVE is a federated system, and CNAs are the orgs approved to issue new CVE Records. In Jan 2016 there were 23 CNAs. Today there are 559.

Andrew Lilley Brinker@alilleybrinker.com

Spending years on an assurance feature you fail to ship, when you have 3 year release cycles, and *this* is happening?

Andrew Lilley Brinker

@alilleybrinker.com

This federation avoids bottlenecking CVE issuance on a small number of orgs. It also means CVEs can be issued by orgs with more domain expertise in the specific software/hardware affected by the vuln! (disclosure: I previously worked at MITRE on the CVE program, though not in MITRE’s CNA side)

24/10/26, 10:45 pm0 reposts10 likes

Andrew Lilley Brinker

@alilleybrinker.com

If you’re curious how CNAs compare on the quality of records they issue, check out CNA Scorecard! It’s not perfect, but gives a decent picture of overall quality.

cnascorecard.orgCNA ScorecardCNA Scorecard measures CVE data quality across 300+ CVE Numbering Authorities with transparent scoring and rankings.

Andrew Lilley Brinker

@alilleybrinker.com

Got curious and had Claude whip these up from the cvelistv5 repo.

Andrew Lilley Brinker

@alilleybrinker.com

Andrew Lilley Brinker@alilleybrinker.com

Good news in vuln management world: CNAs of Last Resort issue less than 5% of all vulnerabilities now. That’s a win for the quality of CVE records. No org is equipped to do high-context vuln-report assessments from security researchers across *all* software or hardware.

nathantuck.bsky.social

@nathantuck.bsky.social

It also soared at around the time that side-channel attacks became very popular again. This area has led to a cycle of attempting to build and close barn doors in locations that never should have been allowed to house animals. If you can’t come up with a side-channel CVE in 15 minutes…