Comment by danso
11 hours ago
The CVE system is far, far from perfect and NIST has faced increasing criticism (even before 2025) about its ability to triage and process the backlog. But I don't think their role is limited to simply posting what’s sent to them?
https://www.securityweek.com/cve-and-nvd-a-weak-and-fracture...
They have nothing to do with the number is my point. They don't uncover anything.
"They"? MITRE runs cve.org under contract by CISA.
The name is amusingly often misunderstood in Germany as a French government agency (this is anecdata, I‘ve just heard that several times in the last few months). It just sounds French, I guess.
But they don’t research, validate, or PoC anything. It’s a just a centralized place to issue unique ids and eventually publish a bunch of text.