CVE Foundation

Edit suggests the contract has been renewed last minute.

https://www.forbes.com/sites/kateoflahertyuk/2025/04/16/cve-...

To all the comments doubting the legitimacy:

Here is a LinkedIn post by one of the CVE board members (literally the first one on the list here[0]): https://www.linkedin.com/posts/peterallor_cve-foundation-act...

I'm sure if you look at some of the contact information of other CVE board members and their broadcasting platforms you will also find something.

[0]: https://www.cve.org/programorganization/board

Related ongoing threads:

CVE program faces swift end after DHS fails to renew contract [fixed] - https://news.ycombinator.com/item?id=43700607

Replacing CVE - https://news.ycombinator.com/item?id=43708409

I think it's time the biggest players in the software industry step up, maybe through a formal consortium. This model would make sense because they benefit the most. Big tech companies rely on CVEs to secure their own products;

They have the means. With their massive revenue and dedicated security teams, these companies could easily fund CVE operations. A consortium approach spreads responsibility fairly;

Shared responsibility, shared benefits. Security is everyone's problem.

Funny people keep saying the government should 'move fast and break things' like Facebook, and leave out that Facebook has committed to $60 billion to $65 billion in expenses to do that process this year. But somehow when it's government moving fast and breaking things that also somehow includes 'having minimal expense'. Something something "Fast, Cheap, or Good, pick two." something something.

As this is security, assume the worst: it isn't legit unless MITRE confirms a handover, and even in that case there's ample room for questioning.

I haven't been actively monitoring for security vulnerabilities ever since I switched from system administration to software development a few decades back. These days, I just read news that talks about high profile vulnerabilities - I do see CVE a lot more than cert.

We used to look at cert: https://www.kb.cert.org/vuls/ I just did a quick search to confirm that it is still there.

What's the difference/relationship between the two?

Curious what the MITRE budget was. CISA funding for the CVE program isn't specifically broken out but "tens of millions of dollars per year" is what I've seen, which seems excessive, despite the CVE program being important.

Hear me out, I wonder if the need for a decentralized database of data like this might be an actual good use for block chains?

Requires consensus

Immutable

Distributed

A user who needs the CVE database thus just needs to grab a copy of the ledger off of bit torrent or wherever and parse it for all data or updates, etc. It's not like CVEs get lots of updates, and you need to keep track of all of them forever anyways. Updates could be handled by just adding another entry to the chain, and bad actors couldn't really tamper with it.

As somewhat of an aside, this development doesn't necessarily mean much in the way of changes to the way the program is currently run. The foundation can act as a conduit/collection point for funding from industry, with the program remaining run under a contract with MITRE.

Hopefully this is legit. There is no real info. They say both that they are responding to the announcement and that they have been planning it for a year. I doubt that the last part was intensely planned or they’d likely have announced something sooner.

I suspect some likely fracturing of efforts here. Would be great if everyone did get behind a single solution. I’m not sure if this is it. A US-based non-profit is not maybe the best solution.

Comments are understandably negative as the press release has very little information, but I clicked vouch because I have a reason to believe it is legitimate