Security alert: CVE contract expiration and option period

This briefing reports that funding for the federally supported CVE program was set to expire on April 16, 2025, but CISA secured an approximately 11-month extension for MITRE’s support to prevent a lapse; it highlights the importance of CVE as the de-facto vulnerability registry, the risks of contract instability for government and industry, and notes the emergence of private alternatives (The CVE Foundation and Global CVE Allocation System) amid ongoing uncertainty.