Future of CVE Program in limbo as CISA, board members debate path forward

CISA released planning documents asserting a lead role in the CVE Program and proposing a roadmap emphasizing trust, data quality, transparency, diversified funding, and broader global participation, following a funding scare that nearly shuttered CVE.org. Several CVE Program board members and the newly formed CVE Foundation favor a globally supported, vendor-neutral nonprofit model and question CISA’s stewardship claims and contract transparency with MITRE. Contribution data shows the vast majority of CVE entries come from global voluntary sources, while CISA and U.S. tax-funded contributions constitute a small fraction, prompting wider community discussions on improving transparency, responsiveness, and collaboration in the program.