Comment by vasco
9 hours ago
Do the agencies do any research to find CVEs? Or do they run a mostly cacheable website where they simply get posted?
9 hours ago
Do the agencies do any research to find CVEs? Or do they run a mostly cacheable website where they simply get posted?
The CVE system is far, far from perfect and NIST has faced increasing criticism (even before 2025) about its ability to triage and process the backlog. But I don't think their role is limited to simply posting what’s sent to them?
https://www.securityweek.com/cve-and-nvd-a-weak-and-fracture...
They have nothing to do with the number is my point. They don't uncover anything.
"They"? MITRE runs cve.org under contract by CISA.