Governing Global Vulnerabilities: Standards for Open Source Resilience
summary
Global vulnerability handling now pairs CVE identifiers with machine-readable ingredients and decisions: SBOM lists components, CSAF carries advisory metadata and VEX tells whether a consumer is actually affected. CVE counts roughly double in recent years and first.org forecasts ~59,000 in 2026, creating scale problems for ops and auditors. A federated CNA model exists (roots mentor CNAs) and CRA enforces 24‑hour reporting in EU from Sept 2026, while AI inflates noisy reports and CISA funding for CVE maintenance remains uncertain.
AI-written summary · about
chapters (7)
- 0:00Global vulnerability governance intro
- 1:02Developer workflow gaps
- 7:25Open-source dependency challenges
- 12:02SBOMs, CSAFs, and VEX role
- 16:16Regulatory push and CRA compliance
- 21:11Key takeaways
- 36:16Q&A
related talks
01h 00mThe CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data
45mFuture of CVE
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
56mCISA’s North Star Vision for the CVE Program
29mThe Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting Standards
43mOpen Source Runs the World, Why Not Vulnerability Identifiers?
23mHitchhikers' Guide to the Vulniverse
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)