On April 15, 2025, Some big news regarding MITRE's future involvement in CVE Enrichment emerged. MITRE alerted the CVE Board that its current contract to operate and modernize the CVE program (and related programs like CWE) will expire on April 16, 2025 🧵

- Such uncertainties, including NIST's failures in enriching the NVD, could negatively impact vulnerability databases, tool vendors, incident response, and critical infrastructure, globally. In response to this potential disruption, a new CVE Foundation has been launched.

- The CVE Foundation is a non-profit, community-driven initiative formed by long-standing CVE Board members. Its mission is to maintain the trust, integrity, availability, and quality of CVE data for cybersecurity defenders worldwide.

- The formation of the CVE Foundation aims to eliminate a single point of failure in vulnerability management and to establish governance that reflects the global nature of cybersecurity threats.

- Meanwhile, to address such failures, we have built intelligent & automated systems which aggregates and interprets exploit and vulnerability data from across the Internet, including vendor advisories, source code repositories, articles, and videos.

- It collects and scores vulnerability and exploit data from over 40 global sources, including CVE, CNVD (China), CNNVD, and BDU (Russia), maps them with products while assigning prioritisation scores as well, providing a broader view than relying on CVE alone.

- As a result, can identify and track vulnerabilities that may not be present in the CVE database, filling gaps when official sources are incomplete or delayed.

- Vulnerability & Exploit Data Aggregation System (VEDAS) & Exploit Observer, together, use OSINT to evaluate the popularity and significance of vulnerabilities, helping prioritise which issues to address first.
https://github.com/ARPSyndicate/cve-scores
https://vedas.arpsyndicate.io

- A.R.P. Syndicate offers comprehensive, real-time, and globally inclusive vulnerability and exploit intelligence, making them essential tools for security teams in a changing vulnerability management landscape.

Reach out to sales@arpsyndicate.io to learn more.

This automated post is based on realtime intelligence from public sources and may be incorrect, inaccurate and may not include all or complete facts.