Loading story…
The CVE Program approved updated CVE Numbering Authority (CNA) Rules that broaden how vulnerabilities can be assigned identifiers and clarify which CNA should handle a report. The revised framework introduces a right-of-first-refusal model that favors the CNA with the most appropriate scope, adopts more technology-neutral criteria for deciding whether an issue merits a CVE, and adds clearer guidance on what types of findings do and do not qualify for assignment.
The changes are expected to affect vulnerability management by increasing flexibility for CNAs and potentially expanding coverage to issues that previously sat in gray areas, including some cloud misconfigurations and certain supply-chain compromises. The updated guidance still leaves open questions around shared code, protocols, specifications, and upstream dependencies, with examples such as HTTP/2 CONTINUATION Flood and HTTP/2 Rapid Reset illustrating the continuing ambiguity over how broadly CVEs should be assigned.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
The Semgrep reference states that version 4.0 of the CVE Numbering Authority Rules was approved by the CVE Program. The article discusses the rule changes, including right-of-first-refusal, technology-neutral assignment decisions, and clarified CVE eligibility guidance.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA said the **Common Vulnerabilities and Exposures (CVE) Program** should be placed on firmer legal footing, but warned Congress not to impose overly prescriptive rules that could limit the program’s ability to adapt. The debate follows a 2025 funding scare tied to MITRE’s contract, which exposed the risk of relying on a single U.S. federal agreement to support a vulnerability identification system used globally. Agency officials said CVE governance must stay flexible as **artificial intelligence** accelerates vulnerability discovery and as the ecosystem becomes more internationally distributed. CISA pointed to proposals that would authorize CVE within the Department of Homeland Security, formalize CISA’s role, require a modernization plan with **NIST**, and establish a 15-member governing board, while also noting **ENISA’s** expanding role as both a CVE Numbering Authority and a CVE Root as evidence that the program is moving toward a more federated global model.
Aug 7, 2026
The Global CVE initiative has published **GCVE BCP-12**, a proposed standard for recording and exchanging vulnerability sightings across vulnerability-management platforms, security tools, feeds, and analysis systems. The specification is based on the sighting model already used in **Vulnerability-Lookup** and is designed to capture time-bound assertions from specific observers rather than treating each report as a universal fact, allowing multiple organizations to share complementary or conflicting observations about mentions, analyst validation, proof-of-concept release, exploitation, and patching outcomes. The release comes as vulnerability-tracking data shows rising pressure on defenders and growing demand for better interoperability. DKCERT, citing Vulnerability-Lookup's June 2026 report, said **7,454 CVEs** were published in June and more than **27,000 sightings** were aggregated, including over **8,500** directly tied to exploitation; nine of the ten most observed vulnerabilities also appeared in CISA's Known Exploited Vulnerabilities catalog. The report highlighted active attacker interest in remote access, network appliances, and identity services, with heavily watched flaws affecting Oracle PeopleSoft, Cisco, Ivanti Sentry, SimpleHelp, Check Point Security Gateway, BeyondTrust Remote Support/PRA, and even older issues such as the 2017 HP iLO 4 authentication bypass, underscoring why a common sighting format is being advanced for public review.
Aug 13, 2026
**NIST is reevaluating its role in analyzing and “enriching” vulnerabilities in the National Vulnerability Database (NVD)** as demand for vulnerability analysis continues to outpace the agency’s capacity. NIST leadership told the Information Security and Privacy Advisory Board that the enrichment process is *labor-intensive* and “not scalable” given the volume of incoming CVEs, prompting a strategic review and a shift toward **prioritizing/triaging** which vulnerabilities receive deeper analysis. The broader ecosystem is also seeing parallel efforts to improve vulnerability correlation and disclosure workflows outside of any single identifier system. *Vulnerability-Lookup* is positioned as a sharing and correlation platform that aggregates vulnerability information from multiple sources, supports sightings (e.g., *seen*, *exploited*, *patched*), and is designed to operate independently of specific vulnerability IDs while remaining compatible with the **Global CVE Allocation System (GCVE)**—highlighting how tooling and processes are evolving as stakeholders question scalability and governance of centralized vulnerability analysis.
Jul 12, 2026