Funding Expires for Key Cyber Vulnerability Database

Summary: MITRE warned that its contract to maintain the Common Vulnerabilities and Exposures program, traditionally funded by the Department of Homeland Security through CISA, was set to expire on April 16, 2025, and that new CVEs would not be added after that date. The contract was awarded approximately $40 million last year, and the CVE board announced a new non-profit, The CVE Foundation, while MITRE later said it had identified incremental funding to keep the programs operational.
Why it matters: Hundreds of CVE Numbering Authorities assign the tracking numbers that feed the tools organizations use to prioritize patching, and MITRE Vice President Yosry Barsoum warned a break in service would affect vulnerability databases, tool vendors, incident response operations, and critical infrastructure.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2024-43573
Related: CVE-2024-43573: Microsoft Windows MSHTML Platform Spoofing Vulnerability Known Exploited Vulnerabilities · Oct 08, 2024
Largest Patch Tuesday since July includes two exploited in the wild, three critical vulnerabilities Cyber Risks ·
Patch Tuesday, October 2024 Edition Cyber Risks ·