CPE Metadata: Know IT ALL
summary
NVD slows metadata enrichment in 2024, leaving scanners hungry for identifiers; historically only 13.3% of all CVEs include CPEs, while CNA-published JSONs jump to 26% in 2023 and 54% in 2024. There are 447 CNAs in 2025 and 288 CNAs (64%) include CPEs in their JSONs, yet many still rely on manual processes — MongoDB keeps a Google Sheet CPE database and copies entries into JSON — so CNAs are urged to self-enrich to avoid gaps.
AI-written summary · about
chapters (10)
- 0:00CPE metadata importance
- 1:29CVE ecosystem overview
- 3:01What is CPE
- 6:08CPEs in vulnerability management
- 8:19Missing CPE metadata problem
- 13:02CVE issuance growth
- 16:17MongoDB self-enriches CVE metadata
- 19:31CPE structure explained
- 21:57CNAs should self-enrich CPEs
- 22:42Q&A
related talks
33mCVE Decaf: Brewing Better and More Actionable Data Quality
45mFuture of CVE
41mNIST’s National Vulnerability Database Update and the Vulnerability Enrichment Ecosystem
30mThe Growing Crisis in CVE Data Quality
35mVulnrichment Playground
46mCVE Record Format - Purl and CPE Workshop
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
27mSecurity Content Metadata Model with an Efficient Search Methodology For Real Time Monitoring...