CVE/FIRST VulnCon 2025
2025-04-07..2025-04-10
-- online --
[CVE/FIRST VulnCon 2024 & Annual CNA Summit, CVE/FIRST VulnCon 2025, CVE/FIRST VulnCon 2026 & Annual CNA Summit]
| title | author | length |
|---|---|---|
| Practical Software Bill of Materials: From Generation to Distribution Workshop | Adolfo García Veytia, Ian Dunbar-Hall, Michael Lieberman | 01h 26m |
SBOMs are generated with Trivy (or Syft), augmented with sbom-azim or a checked-in JSON and jq, then enriched via Parlay(ecosystems) to add licenses, repos and… | ||
| Vulnerability Root Cause Mapping with CWE | Alec Summers, Chris Madden | 57m |
Claims that grounded LLM workflows can scale CVE→CWE mapping are backed by a prototype that combines sparse/dense/graph retrievers to cut ~1,000 CWEs to a… | ||
| BOF: Vulnerability Data Consumers | Jay Jacobs | 25m |
People describe concrete pain: brittle JSON/XML parsing, lots of one-off checks, and mass flattening of nested arrays; common tooling is bash + jq and Splunk… | ||
| The Enriched CVE Record: Redefining Completeness and Quality for Greater Impact | Alec Summers | 38m |
CVE records now include CNAs adding structured metadata like CVSS, CWE and CPE at disclosure, driven by an April 2024 enrichment initiative that produces a… | ||
| Validating Vulnerability Analysis with Statistical Analysis of Metadata | Alexander Bushkin, Chess Hazlett, Keith Grant, Marian Rehak | 31m |
Claims that metadata can predict analyst impact decisions get tested on a 7,415-vulnerability dataset using CVSS, CWE and component fields. CVSS vectors get… | ||
| Vulnerability Data Analysis with Google Spreadsheets and Apps Script for Fun and Profit | Andrew Pollock | 58m |
Live demo shows pulling CVE metadata into Google Sheets using importJSON plus Apps Script to call CVE List, NVD, OSV.dev and GitHub advisories, producing… | ||
| Using Jupyter Notebooks to Explore Public CVE Data | Jerry Gamblin | 41m |
Provides ready-to-run Jupyter notebooks and a GitHub repo that pull NVD via the NVD 2.0 API and a 1.3 GB consolidated JSONL hosted at nvd.handsonhacking.org… | ||
| Don’t Forget the Little Guy: Vulnerability Management in Operational Technology | Alex Assante, Kylie McClanahan | 57m |
Vulnerability management in OT is radically different from IT: regulators impose a 70 day compliance window split into 35/35 review and remediation days… | ||
| Diagnosing the Hurdles in the Medical Device Regulatory Landscape | Ethan Muntz, Taylor Porter | 26m |
Regulatory hurdles center on concrete requirements and risks: the FDA has cleared 1,000 AI-enabled devices from 1995–2024, the EU classifies healthcare AI as… | ||
| Securing the Future: Navigating AI Vulnerabilities and Evolving Security Practices | Lisa Bradley, Sarah Evans | 31m |
Dell documents a year of practical work: an internal AI threat library, concrete poisoning categories like label flipping and backdoor attacks, and a push to… | ||
| From NIST to FIRST: How GitHub’s Product Security Response Organization Transitioned | Jeffrey Guerra, Sara Clements | 29m |
GitHub documents a concrete migration from NIST to the FIRST Services Framework and a split of IR into a corporate CERT and a product PSIRT, using SIM3 as the… | ||
| Product Security Incident Response at a Fortune 500 SaaS | Garrett McNamara | 42m |
ServiceNow PSIRT runs a 12‑person team that grows from a 2.5‑year build into 12 engineers on three continents, and operates as a CNA/member of FIRST.org. The… | ||
| Towards a Minimum Viable Enumeration of Vulnerabilities | Art Manion, Jay Jacobs | 28m |
Proposal claims the absolute MVVE is just two fields: a unique public identifier and a product identifier including version/build, enough to initiate discovery… | ||
| Establishing a Global Community of Practice on Coordinated Vulnerability Disclosure (CVD) | Justin Murphy, Tomo Ito | 27m |
A global Community of Practice on Coordinated Vulnerability Disclosure is established (Dec) to harmonize guidance for third‑party CVD coordinators, meeting… | ||
| Where Do We Aim? A Look at the State of Vulnerable Software Identification and Its Future | Andrew Suter | 26m |
CPE remains the NVD-maintained dictionary for product-level mapping while Pearl targets package distribution points and downstream rebundles, and both support… | ||
| Belgian Federal Government invites Ethical Hackers for First-Ever 'Hack the Government' Event | Johan Caluwe, Susan Bushe | 01h 05m |
Belgium opens selected federal assets to ethical hackers under a new CVDP safe-harbour law and runs a 15-day “Hack the Government” event using the Integrity… | ||
| Who’s Vulnerability Is It Anyway? Harmonizing Stakeholder Roles in Vulnerability Management | Havaya Garti, James Berthoty, Kayla Underkoffler, Yotam Perkal | 59m |
Panel argues that the bottleneck is inventory and remediation, not topic chatter: teams actually build an aggregation layer that dedupes multiple scanners, use… | ||
| With VEX, The Possibilities are (Almost) Limitless! | Vincent Danen | 28m |
A vex-reader Python library parses CEF VEX and powers a lightweight Flask site that recreates CVE pages from VEX plus NVD, CVE.org and EPSS, and it outputs a… | ||
| Modeling Asset Risk Using Grouped EPSS | Stephen Shaffer | 27m |
Calculates the probability that at least one CVE on an asset is exploited in 30 days by taking the product of (1 − EPSS) per CVE and inverting it, implemented… | ||
| Distributing Product Vulnerability Information: The Cisco VEXperience | Dario Ciccarone | 57m |
Demo of Cisco’s CVR portal (prod May 2022, VEX download added Jun 2023) and an analysis of ~170k valid queries shows concrete results: 6,589 VEX downloads… | ||
| Weaving a VEX Feed Through the Kubernetes Project | Adolfo García Veytia | 27m |
Kubernetes now publishes a machine-readable VEX feed that ties CVEs to specific branches, modules and container images using OpenVEX, created from three… | ||
| Streamlining Vulnerability Management: The Power of VEX Inheritance in Container Ecosystems | Jessica Butler, Kaajol Dhana | 26m |
Since October 2023 a VEX publishing pipeline outputs CycloneDX VEX for NVIDIA AI Enterprise images on NGC and a parent-image registry plus SBOM diffing reduces… | ||
| Adversarial Intelligence: Redefining Application Security Through the Eyes of an Attacker | Mahesh Babu, Roy Talyosef | 28m |
Experience at NSO/Peagas-like operations shows that plentiful low and medium CVEs are weaponized by chaining them, with a six‑month NVD snapshot showing huge… | ||
| Distribution Builders Meet VEX | Marta Rybczynska | 30m |
Yocto Project builds generate CV metadata that is already close to VEX: the build system’s CV check detects package-level CVEs, honors per-recipe patch files… | ||
| Models and Systems: How to Think About Vulnerabilities and Artificial Intelligence | Erick Galinkin | 35m |
Distinguishes models (architecture and parameters) from systems and argues CVE assignment follows CNA rules: issue IDs when a system context yields… | ||
| AIBOM: Powering Transparency and Security in AI and Software Supply Chains | Dmitry Raidman | 29m |
AIBOM (AI SBOM) maps exact model lineage, data sources, frameworks and hardware so teams can spot vulnerabilities like data poisoning or model trojans… | ||
| Nothing to Risk but Risk Itself: Expanding Vulnerability Risk with Internet-Scale Data | Ben Edwards, Sander Vinberg | 58m |
Claim: expanding measurements yields actionable vulnerability prioritization. Uses Bitsight’s Groma internet scanner plus EPSS, CVSS vectors, KEV lists and… | ||
| How Do We Leverage CVE Root Cause Mapping and CWE Data to Prevent New Vulnerabilities? | Alexander Bushkin, Jeremy West | 28m |
Argues that blending CVE root‑cause mapping with CWE identifiers makes vulnerability work actionable by counting occurrences, mapping them to components, and… | ||
| Open Discussion - International Challenges with CVD, CNA, and CVE | Rina Rakipi, Tomo Ito | 01h 04m |
Discussion documents concrete pain points and fixes: inconsistent definitions of coordinated vulnerability disclosure that fragment triage, expensive… | ||
| Breaking the Bot: GenAI Web App Attack Surface & Exploitation | Ken Smith | 01h 14m |
Covers a threat‑modeling workflow (PASTA) and an OWASP Top 10 for LLM apps with hands‑on exploits: demonstrates a successful prompt injection that returns bomb… | ||
| Software Identity in the Vulnerability Management Ecosystem | Alec Summers, Andrew Lilley Brinker, Christopher Turner, Mz Megazone, Steve Springett | 50m |
CVE record format now embeds real CPE support so consumers can reuse NVD-style names and the new CPE applicability added field offers concise version-range… | ||
| Quick Start Session For Using CPE Within the CVE Record Format | Chris Coffin | 29m |
CVE Record Format 5.1.1 adds a new cpeApplicability array that implements CPE Applicability Statements and matches NVD configurations so producers can express… | ||
| Open Interchange on CPE - Purl Between Communities of Interest and the CVE and NVD Programs | Chris Coffin, Christopher R Robinson, Peter Allor | 01h 51m |
Proposes adding Pearl identifiers and Omnibore references into CVE/JSON to stop scanners inventing product IDs, shows CNAs and NVD are under-reporting CPEs… | ||
| Outpacing Attackers: How Data-Driven Insights Speed Up Vulnerability Remediation | Saeed Abbasi | 56m |
Qualys analyzes 750 million records (part of ~6 billion scans/year) and finds 39% more CVEs in 2024 (~40,000), with 245 weaponized and 321 unique CVEs studied… | ||
| OpenEoX | Przemysław Roguski | 29m |
A standard-format project that encodes product lifecycle phases, versioning and support scope as machine-readable records, mapping versions to identifiers such… | ||
| What's New in CSAF and OpenEoX | Justin Murphy, Omar Santos | 27m |
CSAF moves toward a 2.1 community draft that adds CSAF 2.1 schema changes: publisher object with multiple categories, plural CWE entries, discovery/disclosure… | ||
| Unlocking the Power of SBOMs: A Deep Dive into Risk Management and Cybersecurity Posture | John Bergland, Zadia Alden | 29m |
SBOM analysis pipeline automates ingestion, runs scanners (Dependency-Track, Prisma Cloud, Twistlock, Fossa) and produces a standardized business-friendly… | ||
| EU CRA TL/DR for PSIRTS - What Product Security Needs To Do To Be Compliant with the CRA | Christopher R Robinson | 01h 18m |
Regulation requires concrete changes: Annex I: 21 requirements forces secure‑by‑design evidence, risk assessments per ENISA, and documented five‑year support… | ||
| EU Cyber Resilience Act - A Product Owner’s Approach | Langley Rock | 22m |
EU CRA requires concrete changes now not later: Sept 2026 vulnerability‑response rules kick in, with main obligations by Dec 11 2027 compliance deadline and… | ||
| The EU Cybersecurity Resilience Act (CRA) - Boring, Scary or Exciting? | Mike Bursell | 32m |
Companies that sell products with digital elements in the EU are manufacturer, steward, maintainer in different legal roles: maintainers have no obligations… | ||
| Applying Cybersecurity Regulations and Industry Standards to Open Source Projects | Luci Stanescu | 48m |
Demonstrates that regulatory checklists and open source tooling can be aligned: the NCSC VSA’s 58 criteria yield 32 of 58 mapped to OpenSSF best practices, and… | ||
| The Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting Standards | Jerry Gamblin | 29m |
CVE records often publish with only three required fields and the sole automated description check is a 1–4,916 character length limit; the CVE schema lists… | ||
| CPE Metadata: Know IT ALL | Karman Liu | 30m |
NVD slows metadata enrichment in 2024, leaving scanners hungry for identifiers; historically only 13.3% of all CVEs include CPEs, while CNA-published JSONs… | ||
| Madness of Vulnerability Management in Modern Cloud, Container, How to Win the Battle... | Francesco Cipollone, Nate Sanders | 59m |
Modern cloud vulnerability counts jump ~40x since 2015 with the NVD showing ~262,000 entries and projections near a million by 2031, so the practical claim is… | ||
| State of EPSS and What to Expect from Version 4 | Jay Jacobs | 58m |
EPSS v4 claims to predict the probability a CVE sees exploitation in the next 30 days and expands sources to include malware, GitHub, Shodan and commercial… | ||
| CNA Birds of a Feather: Open Forum with Certified Numbering Authorities | David Welch, Jonathan Evans, Lisa Olson, Scott Moore | 51m |
Panelists trace CVE evolution from a handful of manual assignments to a federated system that now lists 450 CNAs, produces about 108 CVEs/day and logged… | ||
| Vulnrichment: Year One | Art Manion, Lindsey Cerkovnik | 30m |
CISA publishes machine-readable vulnerability enrichment back into the CVE corpus via CVE ADP, and mirrors records and public disputes on GitHub Issues so… | ||
| UC2 Risk Ruler for CVSS 4.0: Visualizing Vulnerability Severity and Data Confidence | Rob Arnold | 28m |
The UC2 Risk Ruler augments CVSS 4.0 by visualizing score precision, maturity and data confidence, converting vendor base scores into confidence-aware bins and… | ||
| CVSS v4.0 By The Numbers | Nick Leali | 50m |
Analysis of public CVSS v3.1 vs v4.0 vectors shows measurable re‑scoring, not just wording changes: a Cisco sample of 308 Cisco CVEs averages +0.36 points (max… | ||
| Updates from the CVSS SIG | Nick Leali | 24m |
Recent SIG activity reports 5,000 CVSS v4 vectors in the CVE program, ~8,000 on GitHub, and 56 unique vendors producing v4 scores; a 2024 survey with 500+… | ||
| Towards a Vulnerability Reporting Specification | Marta Rybczynska, Mikaël Barbero | 24m |
A minimal, CRA-focused vulnerability reporting specification targets clear, auditable requirements rather than guidance prose: a two-page draft lists concrete… | ||
| Ask Not Whether CVSSv3.1 and v4 Scores are Inconsistent, But What Can You Do About It | Mengyuan Zhang, Siqi Zhang | 27m |
Paper analyzes inconsistencies between CVSS v3.1 and v4 using over 2,000+ public and 6,000+ private CVEs, finds large divergence for user interaction and… | ||
| Exploit Maturity: Your New Best Friend in CVSS | Shelby Cunningham | 32m |
CVSSv4 adds an exploit maturity metric with three levels: Attacked (exploited in the wild), POC (public proof‑of‑concept), and Unreported (no public proof)… | ||
| Merging Security and Compliance: Perspectives on Emerging Regulations and Best Practices | Christopher R Robinson, Eddie Knight, Michael Lieberman | 59m |
The EU Cyber Resilience Act creates legal duties mainly for manufacturers selling “products with digital elements,” shifts liability downstream (maintainers… | ||
| Managing Vulnerabilities through SSDLC | Luci Stanescu | 30m |
Canonical implements a company-wide SSDLC that combines an in-house threat‑modeling method for open source (draw explicit asset graphs with crown jewels and… | ||
| Production, Consumption, and the Data: The Open Source Security Sandwich | Michael Lieberman | 28m |
Argues that security requires stitching production metadata to consumption controls and demonstrates an implemented pipeline: ingest SBOMs, OpenSSF Scorecard… | ||
| The Open Source Paradox: Unpacking Risk, Equity, and Acceptance | Vincent Danen | 58m |
Covers concrete data: CVE counts balloon (4,400% growth from 1999 to 2024) while actual exploitation stays less than 1% exploited using SISA’s KEV and Verizon… | ||
| Building Trust Through Proactive Security - Key Parts of the Trusted Software Supply Chain | Przemysław Roguski | 27m |
Red Hat describes an open-source build factory called Conflux built on Tekton that enforces supply‑chain controls, emits provenance and meets SLSA level 3… | ||
| Alpha-Omega: What We've Learned From Funding Open Source Security Over the Past 3Years, What's Ahead | Michael Winser | 53m |
Alpha-Omega reports raising about $23M and granting over $8M to open source security since 2022, pivots from mass scanning (top 2,000 PyPI projects) to… | ||
| Vulnerability Response of Last Resort | Diogo Sousa | 27m |
Distributions propose acting as a Vulnerability Responder of Last Resort by gathering hard data on abandoned upstreams, routing reports to forks or downstream… | ||
| Identifying and Assigning AI Model Vulnerabilities | D’Nae Ferguson, Kyle Kilian | 29m |
The presentation argues that conventional bugs in AI libraries fit existing CVE processes but model behavior flaws (hallucinations, prompt‑injection… | ||
| Challenges in Open Source Software Identification | Martin Prpič | 50m |
Ecosystem fragmentation causes concrete failures: purl <10 CVE records despite wide OSV and SCA support (SIFT, Guac), while CPE applicability is used by… | ||
| Airflow Beach Cleaning - Supply Chain Security with Community in Mind | Jarek Potiuk, Michael Winser | 28m |
A focused supply-chain exercise uses CycloneDX SBOMs and automated scorecard checks to evaluate 719 dependencies, starting with 16 high-risk packages and a… | ||
| From Idea to Open-Source: Building CNA-GURU, a Generative AI Assistant for Security Advisories | Ryan Nolette | 30m |
An open-source assistant called CNA‑GURU evolves from a prototype into three portable deployments (full Bedrock-backed service, cost‑reduced local RAG “Jr.”… | ||
| Let’s Talk About Fitness for Purpose: Comparing and Contrasting the CVE List with OSV.dev | Andrew Pollock | 55m |
Automated conversion from the NVD to OSV produces commit‑level metadata for C/C++ and sustains a consistent conversion rate; OSV.dev aggregates 82,000 records… | ||
| Lessons from OSV: Vulnerability Management for Open Source | Oliver Chang | 24m |
OSV started in 2021 and becomes a de facto open‑source vulnerability format used by GitHub, Canonical, Red Hat and others across 28 ecosystems; the aggregated… | ||
| Breaking the Build: How Attackers Abuse GitHub Actions | Jonathan Evans | 23m |
Overview of concrete exploits against GitHub Actions: three classes—action expression injection (CVE-2023-34111) lets attacker-controlled PR titles inject… | ||
| Efficient Vulnerability Management in Hierarchical Supply Chains | Thomas Kittel, Tobias Limmer | 31m |
Siemens builds a central vulnerability intelligence DB and a product-mapping database that links OS packages, proprietary components and SBOM entries, and runs… | ||
| Where The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories | Munawar Hafiz | 53m |
Three community engagements (Apache Airflow, Jenkins, Kubernetes) scan source trees and dependencies to find previously undetected bugs, report them… | ||
| Identifying Malicious OSS Across Ecosystems | Dan Fiedler | 27m |
Microsoft builds a pipeline called osimilation that pulls neutral metadata from libraries.io, enriches it with registry-specific fields (npm install scripts)… | ||
| Securing Citizen Developers: A New Opportunity to Build Safe Applications | Kayla Underkoffler | 24m |
Zenity’s 2024 data shows environments hosting over 79,000 applications with 39.1% year‑over‑year growth, and the top build‑time risks are authorization misuse… | ||
| Operationalizing SSVC | Lindsey Cerkovnik, Sean Letona | 32m |
CISA explains how SSVC is used end-to-end: the agency implements the SSVC decision tree since April 2020, publishes the first three decision points for each… | ||
| The National Vulnerability Database (NVD) – Where It Is and Where It’s Going | Matthew Scholl, Tanya Brewer | 30m |
NVD reports a new enrichment team and development team fully onboarded, APIs restored to stable, and a proof‑of‑concept tool for automating Linux kernel CPEs… | ||
| CISA’s North Star Vision for the CVE Program | Alec Summers, Ben Edwards, Bob Lord, Sandy Radesky | 56m |
CISA lays out a practical North Star: scale federation to get from completeness to quality, add operational enrichments like SSVC into CVE records, and push… | ||
| Resolution Revolution: Turbocharging Security Ticketing Timelines | Joseph Seasly, Shruti Datta Gupta | 38m |
An Adobe security AI team builds a unified knowledge base that merges bug details, code snippets and expert notes to cut ticket turnaround times; it processes… | ||
| Evolving Secure Development through FedRAMP Continuous Monitoring Trends | Christopher Lusk, Stephanie Harris | 34m |
Red Hat analyzes FedRAMP continuous monitoring from Jan 2023–Jan 2025 and finds 1,500 CVEs across 220 components (excluding 673 kernel issues), scope triples… | ||
| Exploited CVEs of 2024: Lessons for Vendors and Defenders | Patrick Garrity | 27m |
2024 records show over 750 CVEs confirmed exploited in the wild, with roughly 2,000 reference citations from 100+ sources (Shadow Server, MSRC, CISA KEV… | ||
| Building a PSIRT for a Standards Organization | Jim Duncan | 20m |
Standards group creates a vulnerability response framework after ten months and 150+ substantive comments, establishing a VRT of 4–6 responders nominated by… | ||
| CVE Unmoored: Implications of the Removal of the Technology Requirement | Jonathan Evans | 20m |
Rule change removes the no technology requirement so CVE assignment expands from software to cloud services, websites, CI/CD pipelines and some hardware cases… | ||
| Context Matters: Qualitative Insights into Developers’ Approaches and Challenges with Software... | Elizabeth Lin | 38m |
Paper reports results from 16 semi-structured interviews with developers who use SCA and finds one clear claim: context matters — alerts are too generic… | ||
| Managing Risk Across the Vulnerability Ecosystem | Julia Hopkins, Cassi Rodano, Patricia Tarro | 40m |
Dell builds a dependency management platform that ingests product inventories and exports SPDX 2.3 SBOMs, uses a SEA tool backend to feed automated… | ||
| State of Attack Surface Elimination in a World Plagued by Vulnerable Software | Gaurav Gogia, Mayuresh Dani | 21m |
Claims a system called VEDA (Vulnerability Elimination through Deep Analysis) that finds vulnerabilities inside binaries without relying on package versions… | ||
| When it Comes to Managing Risk, Context is King | Lucas Tamagna-Darr | 51m |
Tenable Research shows CVE totals exceed ~285,000 with ~40,000 published in 2024, and argues CVSS overstates severity while EPSS predicts exploitation… | ||
| Hard Problems in CWE, and What it Tells us about Hard Problems in the Industry | Steve Christey Coley | 59m |
CWE is almost 20 years old and still wrestling with concrete problems: balancing usability with technical rigor, filling classification gaps, and improving… | ||
| CVE Records: The Cybersecurity Glow-Up You Didn’t Know You Needed | Julia Turkevich, Rina Rakipi | 01h 00m |
CISA reports 284 CNAs created ~23,000 CVE records last year with ~12,000 including both CWE and CVSS (71% CWE, 53% CVSS); CISA itself onboarded 40+ orgs… | ||
| BOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX | Lisa Olson, Peter Allor | 50m |
Claims that VEX will cut scanner false positives by encoding VEX attestation status for each CVE and that CESAF/OpenVEX exports can be automated; Red Hat and… | ||
| CVE Record Format - Past, Present, and Future | Chris Coffin, Mz Megazone | 46m |
CVE Record Format is currently at v5.1.1 with work headed toward v5.1.2, having added CVSS4 and a usable CPE applicability block; the repo shows PRs to tighten… | ||
| SBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Scenarios | Cortez Frazier Jr. | 57m |
Three practical workflows: generate SBOM at build time (per build/commit, combine into application-level SBOMs and pin releases), internal aggregation for… | ||
| No Action Required: CVE for Software as a Service | Art Manion, Lisa Olson, Don Bailey, Michael Coté | 54m |
CVE assignment for SaaS now follows revised CNA rules (3.0 → 4.0) and requires showing no action required versus cases that need customer agency; CNAs report… | ||
| VulnCon25 FIRST Event Recap | 01m | |
-- no description -- | ||
| nothing matches | ||