Art Manion
where else to find them
what they talk about
all 4 in the filters
where they keep going back
- CVE/FIRST VulnCon & Annual CNA Summit3 editions2024–2026
all 6 in the filters
on a stage with
all 28 in the filters
who talks about the same things
- Lisa Olson6 talks
- Jay Jacobs20 talks
- Christopher R Robinson24 talks
- Madison Oliver8 talks
- Yogesh Mittal4 talks
- Josh Bressers9 talks
| title | conference | date |
|---|---|---|
| The Vulnerability Identity Crisis | FIRST Conference 2026 (FIRSTCON26) | 2026-06-14 |
Current vulnerability records lack consistent identity, so the talk proposes a structural working definition and a rearchitecture: a vulnerability is a… | ||
| Vulnrichment Playground | CVE/FIRST VulnCon 2026 & Annual CNA Summit | 2026-04-13 |
CISA’s Vulnrichment ADP is delivering machine-readable SSVC, KEV, CVSS and CWE data and is actively experimenting with new fields and policies under “Year 2.”… | ||
| Panel: The CVE Supplier ADP (SADP) Pilot: Am I Affected byUpstream? | CVE/FIRST VulnCon 2026 & Annual CNA Summit | 2026-04-13 |
CVE adds Supplier ADP (SADP) pilot containers to CVE records to publish VEX-like inherited vulnerability status, using the existing CVE-Services ADP endpoint… | ||
| A Paradigm Shift in Vulnerability Identity: Why Vulnerability Databases Struggle | CVE/FIRST VulnCon 2026 & Annual CNA Summit | 2026-04-13 |
Argues for an identity-first redesign that replaces prose-heavy CVE records with small, machine-verifiable assertions; two years of weekly design work shows… | ||
| Supply Chains and Malware Campaigns: Is CVE the Right Way to Name the Game? | CVE/FIRST VulnCon 2026 & Annual CNA Summit | 2026-04-13 |
2025–2026 cases force a tradeoff: XZ utils backdoor (CVE‑2024‑3094) and TJ Actions (CVE‑2025‑30066) show a CVE ID speeds automated alerts and toolchain… | ||
| Towards a Minimum Viable Enumeration of Vulnerabilities | CVE/FIRST VulnCon 2025 | 2025-04-07 |
Proposal claims the absolute MVVE is just two fields: a unique public identifier and a product identifier including version/build, enough to initiate discovery… | ||
| Vulnrichment: Year One | CVE/FIRST VulnCon 2025 | 2025-04-07 |
CISA publishes machine-readable vulnerability enrichment back into the CVE corpus via CVE ADP, and mirrors records and public disputes on GitHub Issues so… | ||
| No Action Required: CVE for Software as a Service | CVE/FIRST VulnCon 2025 | 2025-04-07 |
CVE assignment for SaaS now follows revised CNA rules (3.0 → 4.0) and requires showing no action required versus cases that need customer agency; CNAs report… | ||
| Revising the CVE CNA Operational Rules: AMA | CVE/FIRST VulnCon 2024 & Annual CNA Summit | 2024-03-25 |
A year-long rewrite nearly finishes: the CNA Operational Rules are almost entirely new, not just edited. The rules codify a first refusal for the supplier CNA… | ||
| Panel Discussion: This One Time at CVD Camp | CVE/FIRST VulnCon 2024 & Annual CNA Summit | 2024-03-25 |
Open source projects becoming CNAs (GitHub/Red Hat cited) drives a real influx of IDs and the panel names 20–25% yearly CVE growth as baseline, urging… | ||
| Panel Discussion: Don’t be Vexed by VEX - VEXperts Panel | CVE/FIRST VulnCon 2024 & Annual CNA Summit | 2024-03-25 |
Panel summarizes where VEX is actually used, what tools exist, and what still breaks: lightweight openVEX JSON‑LD statements and CAF/CSAF profiles are… | ||
| FIRST SIG Updates | 34th Annual FIRST Conference 2022 | 2022-06-26 |
CVSS work presents concrete changes: finer-grained base scoring, removal of scope in favor of separate confidentiality/integrity/availability for vulnerable vs… | ||
| Future of CVE | Global Security Vulnerability Summit @ Open Source Summit North America 2022 | 2022-06-23 |
CVE is moving from a GitHub pilot to proper API submission and self-managed CNAs, adds a JSON5 with containers format so multiple data providers can contribute… | ||
| Preparing for Zero-Day: Vulnerability Disclosure in Open Source Software | Linux Security Summit North America 2022 | 2022-06-23 |
OpenSSF publishes a coordinated vulnerability disclosure guide with runbooks, communication templates and a recommendation to coordinated disclosure over… | ||
| Vulnerability Supply Chains | SupplyChainSecurityCon North America 2021 | 2021-10-11 |
Coordinated disclosure and vulnerability management remain manual and guess-driven since 2002 despite incidents like BadAlloc and KRACK; investigations still… | ||
| nothing matches | ||