DIRTY LITTLE SECRETS OF VULNERABILITY MANAGEMENT

Summary from the TLDR InfoSec newsletter

This article explores some common misconceptions about vulnerability management and sheds light on why these make vulnerability management for open source software incredibly complex. It begins by discussing the difference between MITRE's position as secretariat of the CVE program vs the NVD's catalog before addressing why many CVEs that may have exploits available don't make it to CISA's KEV list. The article explains how EPSS scores work and how open source maintainers often skip reporting CVEs and instead only report to the GitHub Advisory Database, complicating matters.