Curiosity in Practice
2024 brought unprecedented growth in CVE data, so I figured it would be appropriate to start the new year by exploring these statistics and highlighting some of the more intriguing data points. CVEs By The Numbers We ended 2024 with 40,009 published CVEs, up over 38% from the 28,818 CVEs published in 2023. CVEs By Month Month … Read more
The Common Vulnerabilities and Exposures (CVE) program, launched in late October 1999, has not only marked its presence but has become a pivotal force in shaping how we perceive and manage cybersecurity threats. A Journey Through Time The CVE program emerged as a beacon, standardizing how vulnerabilities are identified, shared, and mitigated. From its inception … Read more
The Last 100+ Days The NVD posted the notice below on its webpage in mid-February. Since then, nearly 13,000 CVEs have not been enriched with CWE, CVSS, and CPE data. The vulnerability management community was told that it would be addressed at Vulncon this year. At the conference, we were told the enrichment would restart … Read more
Every year, I get asked, “How many CVEs do you think will be published this year?“ I am always willing to take a guess, but last year, I read Time Series Forecasting in Python. As I started to read more about the Kalman Filter, I figured it would work great for predicting CVE growth, so … Read more
2023 marked another year of record growth in CVE data, and I thought it fitting to kick off the new year by delving into these statistics and showcasing some of the more interesting data points. CVEs By The Numbers We ended 2023 with 28,902 published CVEs, up over 15% from the 25,081 CVEs published in … Read more
Hacker Summer Camp, as it is colloquially known, is three security conferences that are all next week in Las Vegas. The three conferences that makeup Security Summer Camp are: While preparing for these conferences, I dug through their schedules and picked out the talks I was most interested in catching. BSides Las Vegas BSides Las … Read more
With the first half of 2023 over, I figured I would take some time and review the data and highlight some of the most interesting data points so far this year. This GitHub repo contains the code for all the data and graphs this blog uses. By The Numbers So far this year, there have … Read more
Reference Rot (also called linked rot) is when hyperlinks, over time, cease to point to their originally targeted file, web page, or server due to that resource being relocated to a new address or permanently unavailable. Tod Beardsley from the CVE board gave a talk at the 2023 CVE Global Summit called ‘Link Rot: The … Read more
2022 was a record-breaking growth year for CVE data, and I figured it would be a great way to start the new year by going through the data and highlighting some of the most interesting data points. All the data and graphs used in this blog are available in this GitHub repo. CVEs By The … Read more
The National Vulnerability Database plays a vital role in the CVE publication process that many people may overlook or not know they are responsible for. After MITRE publishes a CVE, the NVD enriches it with data points that make it actionable by security companies and professionals. Some of these data points include:CWECVSS 3.1 Base ScoreCPE … Read more