CISA Proposes Quality Overhaul for CVE Program as Experts Flag Gaps
Summary
CISA’s white paper proposes improving CVE governance, participation, infrastructure and record quality. Experts welcome the focus but say the plan needs clearer standards, machine-readable software identifiers and more transparent metrics.
Key points
- CISA’s white paper sets out a “Quality Era” plan for the CVE program, focusing on governance, broader participation, infrastructure and more reliable records.
- The article reports that more than 67,000 CVEs had been published in 2026 as of the prior week, while NVD submissions rose 263% between 2020 and 2025.
- CISA says rapid growth in vulnerability reporting can expose gaps in processes, tooling, coordination and accountability, particularly when submissions are uneven.
- Sonatype’s Brian Fox welcomed attention to ecosystem-wide quality, while saying improvements should be judged by their effect on records and decisions.
- OWASP’s Tom Alrich argued that the plan does not address the growing lack of machine-readable software identifiers in CVE records.
- VulnCheck’s Caitlin Condon called for clearer quality standards and public CVE metrics, noting that the white paper is a basis for a future framework rather than a complete one.
Article Details
- Event Type
- CISA released a white paper outlining a plan to improve the CVE program and move it into a “Quality Era.”
- Impact
- The plan emphasizes governance, broader participation, stronger infrastructure, and more reliable CVE records amid rising publication volume and submission rates. Experts welcomed the focus on quality but raised concerns about persistent record-quality issues, missing machine-readable software identifiers, and limited transparency around program metrics.
People
Brian FoxSonatype co-founder and chief technology officer; commented on longstanding CVE record-quality issues and CISA’s proposal.Caitlin CondonVulnCheck vice president of security research; said the white paper could form the basis of a future framework and called for greater transparency about CVE metrics.Chris ButeraCISA acting executive assistant director for cybersecurity; described the white paper as an effort to support stronger CVE program participation and governance.Tom AlrichLeads the OWASP PURL Expansion Working Group; criticized the white paper for not addressing missing machine-readable software identifiers in CVE records.
Vendors
Products
CVE ProgramCISA has released a white paper describing its plan to move the CVE program into a “Quality Era,” focusing on better governance, broader participation, stronger infrastructure, and more reliable vulnerability records.National Vulnerability Databasepublished in 2026 as of last week, and the National Institute of Standards and Technology National Vulnerability Database program has seen a 263% increase in CVE submissions between 2020 and 2025.