A CVE quagmire: Quality versus quantity

In this session, Tod Beardsley (runZero) and Jerry Gamblin (RogoLabs) dive into the "CVE Quagmire," exploring the tension between the sheer volume of vulnerability reports and the actual quality of the data provided. As the industry faces an average of over 160 new CVEs daily, the conversation shifts from fearing an AI-generated tsunami of bugs to addressing the long-standing issue of "human slop" and inconsistent metadata that has hindered security teams for decades.

The discussion highlights the critical need for machine-readable data and standardized scoring, particularly in complex environments like the Linux kernel. Gamblin explains how projects like cve.icu are bringing transparency to the program, while the upcoming CVE Schema 6.0 promises a quality era that could finally mandate the technical details necessary for automated discovery and remediation.