Can a Global, Decentralized System Save CVE Data?

As vulnerabilities in the Common Vulnerabilities and Exposures ecosystem mount, a Black Hat Europe presenter argues for a global, distributed alternative to CVE data, highlighting that the NVD continues to lag in analysing vulnerabilities. In the past five years, more than 155,000 identifiers have been assigned through the CVE process, but only 26% have been enriched with additional data, according to security data analyst Jerry Gamblin, who will present at Black Hat Europe.

He notes that NIST funds the NVD with a small budget and that the backlog was worsened when funding shortfalls halted processing in April 2024, though work resumed three months later; he warns that the status quo is no longer sufficient. The number of vulnerability reports and submitters, CNAs, has grown to more than 357, complicating coordination, while decentralised efforts such as ENISA and EUVD could provide redundancy.

Gamblin proposes a global CVE programme with a single unique identifier for each vulnerability and envisions a decentralised model where data from multiple sources can be normalised and compared, a move he describes as aspirational. According to CVE[.]icu, the share of vulnerabilities lacking fully enriched data for 2025 sits at 52%, underscoring the urgency of broader collaboration and standardisation.