With the EU Vulnerability Database launching and the CVE program hitting turbulence, the global vulnerability disclosure ecosystem is in transition. Here’s what it means for your security team.
In early 2025, the cybersecurity world got a wake-up call. The CVE Program, which underpins the U.S. National Vulnerability Database (NVD), came close to a shutdown due to a funding lapse. The contract between the U.S. government and MITRE, the operator of the CVE program, was set to expire on April 16, threatening the continuity of a system that’s foundational to global vulnerability tracking.
Though a last-minute extension was secured, the incident highlighted the fragility of the CVE infrastructure, and the ripple effects that budgetary instability can have across global security operations.