Back
After MITRE’s Crisis, the Community Responds with EUVD, GCVE & the CVE Foundation

After MITRE’s Crisis, the Community Responds with EUVD, GCVE & the CVE Foundation

NEWS Publication date: 2025-04-22

In the wake of an eleventh‑hour extension of MITRE’s CVE contract—an 11‑month option executed by CISA to “ensure there will be no lapse in critical CVE services” Nextgov/FCWThe Record from Recorded Future—and MITRE’s own confirmation that it “identified incremental funding to keep the programs operational” , the immediate threat of a CVE shutdown has been averted. Yet the broader debate over program resilience and neutrality is far from settled.

 

A European Sovereign Response

 

Europe has responded with two major initiatives aimed at reducing reliance on a single external authority:

 

  • EU Vulnerability Database (EUVD) — Launched by ENISA under Article 12 of the NIS2 Directive, EUVD assigns unique EUVD‑YYYY‑##### identifiers, integrates CVE cross‑references, applies CVSS scoring, and ingests reports from the pan‑EU CSIRT network DataGuidanceheise online. Critically, EUVD will become a mandatory requirement under the upcoming Cyber Resilience Act, which enters into force in the second half of 2024 and obliges manufacturers to supply compliant vulnerability data by 2027 enisa.europa.eu.
  • Global CVE Allocation System (GCVE) — Developed by CIRCL in Luxembourg, GCVE introduces decentralized GCVE Numbering Authorities (GNAs) that can assign vulnerability IDs autonomously, while remaining fully compatible with the standard CVE namespace via a reserved GNA ID 0 GCVE.euGCVE.eu. By removing central bottlenecks, GCVE promises greater scalability and policy flexibility for entities of all sizes.

 

The New Nonprofit Safeguard

 

Amid funding uncertainty, a coalition of long‑standing CVE Board members has spun up the CVE Foundation—a dedicated nonprofit “to ensure the long‑term viability, stability, and independence of the CVE Program” CVE Foundation. Formally launched on April 16, 2025, the Foundation:

 

  • Is governed by a global board representing government, industry, and research stakeholders.
  • Has secured a rainy‑day fund to maintain operations while it finalizes an open, membership‑based funding model.
  • Will publish its transition roadmap, governance bylaws, and opportunities for community involvement in the coming days.

 

This structural shift aims to eliminate the single‑sponsor risk and establish CVE as a truly community‑driven resource.

 

Provisional Backups and Community Mirrors

 

As a stopgap, the CVEProject/cvelist GitHub repository continues to sync the official CVE List every hour, pulling down JSON records within five minutes of publication GitHub. This mirror:

 

  • Stores each CVE record in a year‑and‑block‑based folder structure for easy browsing.
  • Includes extended metadata—such as affected products and problem types—supplied by CNAs but not always present in the official list.
  • Offers a public API and download options, ensuring defenders can still retrieve fresh CVE data even if central services falter.

 

Fragmentation or Resilience?

 

With CVE, EUVD, and GCVE now operating in parallel, the community faces both promise and peril:

 

  • Innovation Through Competition: Multiple registries can drive richer features, faster ID assignments, and regional autonomy.
  • Tooling Complexity: Security vendors and CNAs must update pipelines to consume three distinct identifier schemes, risking delayed coverage or mismatches.
  • Mapping & Interop: Harmonized cross‑references and unified APIs will be essential to prevent blind spots and duplicate work.

 

Whether this multi‑registry landscape evolves into a resilient, polycentric ecosystem—or splinters into silos—will depend on rapid standardization efforts and collaborative governance.

 

What Comes Next

 

1. Toolchain Integration

  • Vulnerability scanners, patch‑management suites, and SIEM platforms must ingest EUVD and GCVE feeds alongside CVE, ideally via a single unified API.

2. Standards Harmonization

  • Industry consortia should define mapping formats (e.g., EUVD ↔ CVE ↔ GCVE) and common CVSS scoring profiles to ensure broad interoperability.

3. Governance & Participation

  • Stakeholders are urged to engage with ENISA’s EUVD Working Group, apply for GNA status under GCVE, and contribute to the CVE Foundation’s open governance process.

4. Funding Models

  • As the CVE Foundation refines membership tiers and sponsors, the community must also explore public–private partnership frameworks to underwrite long‑term sustainability.

 

At BaseFortify, our commitment is to keep you ahead of these shifts. We’re updating our vulnerability‑management playbooks, integrating EUVD and GCVE support into our scanning engines, and refining our advisory services to reflect the new multipolar environment. You can register for free on our platform to start trialing these updates today. As the cataloging landscape evolves, BaseFortify will ensure your organization never misses a critical vulnerability, no matter which identifier it carries.