The Evolution of CVEs, Vulnerability Management, and Hybrid Architectures
summary
Research shows CVE volumes grow from about ~500 CVEs per week today and project toward ~1,000/week within a couple years; the 2016 CNA expansion in 2016 causes much of the jump by letting vendors directly assign IDs. Most vendors publish one CVE while the top ten account for ~35% of all entries. Mean severity isn’t rising in reality but CVSS v3 inflates scores versus v2. Public exploit signals are rare but rising on GitHub — GitHub ~6% exploits — while KEV captures ~0.5% of CVEs.
AI-written summary · about
chapters (18)
- 0:00Introduction and welcome
- 1:53Brief history of CVEs
- 6:14Report findings overview
- 7:43CVE publication trends
- 9:26Weird CVE anomalies
- 13:04Vendor participation analysis
- 15:53Vendor maturity and one-hit wonders
- 18:40CPE and vulnerability scope
- 22:31Common Weakness Enumerations
- 23:34CWE trends and diversity
- 28:46OWASP Top 10 evolution
- 33:23CVE description analysis
- 35:41CVSS severity trends
- 36:24Severity disagreements
- 38:09Exploit code availability
- 42:06Key takeaways and conclusions
- 43:53Hybrid architectures impact
- 46:23Q&A session
related talks
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
54mTowards Real World Cyber Risk (Panel)
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
39mCVE 101: The Unfolding Of A Zero Day Attack
15mKeynote
30mThe Myth of the Meteoric Rise in Vulnerabilities
30mThe Growing Crisis in CVE Data Quality