GCVE launches as a decentralized system for tracking software vulnerabilities

A European cybersecurity body (CIRCL) launched the Global CVE Allocation System (GCVE), a decentralized framework for assigning vulnerability identifiers that allows independent numbering authorities and preserves compatibility with existing CVE IDs (e.g., GCVE-0 mapping). The move follows governance and funding strains on the traditional CVE ecosystem, including near-shutdown risks and NIST metadata cutbacks, and aligns with broader EU cyber infrastructure. Parallel efforts include the formation of the CVE Foundation, CISA’s reform proposals, and external recommendations for a global vulnerability catalog.