# vulnerability data

Published articles for vulnerability data.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Why Vulnerability Clearinghouses Alone Cannot Secure Open Source

DevFeed: [Why Vulnerability Clearinghouses Alone Cannot Secure Open Source](<https://devfeed.tech/articles/summer-of-clearinghouses-13244.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/summer-of-clearinghouses>)

Published: 2026-07-05T00:00:00Z

Content type: opinion

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [data](<https://devfeed.tech/topics/data.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Security](<https://devfeed.tech/topics/security.md>), [NVD](<https://devfeed.tech/topics/nvd.md>), [Unix](<https://devfeed.tech/topics/unix.md>)

Tags: [akrites](<https://devfeed.tech/tags/akrites.md>), [athena](<https://devfeed.tech/tags/athena.md>), [chainguard-libraries](<https://devfeed.tech/tags/chainguard-libraries.md>), [data](<https://devfeed.tech/tags/data.md>), [ibm-red-hat-project-lightwell](<https://devfeed.tech/tags/ibm-red-hat-project-lightwell.md>), [nvd](<https://devfeed.tech/tags/nvd.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [press-release](<https://devfeed.tech/tags/press-release.md>), [secure-open-source](<https://devfeed.tech/tags/secure-open-source.md>), [security](<https://devfeed.tech/tags/security.md>), [security-research](<https://devfeed.tech/tags/security-research.md>), [vulnerability-clearinghouse](<https://devfeed.tech/tags/vulnerability-clearinghouse.md>), [vulnerability-data](<https://devfeed.tech/tags/vulnerability-data.md>)

### AI overview

The article argues that vulnerability clearinghouses are primarily pools of data and are not the most important part of securing open source. It emphasizes actuation--turning findings into fixes--along with trusted builds and secure-by-design software.

### Source excerpt

Clearinghouses alone won't secure open source. Learn why actuation, trusted builds, and secure-by-design software matter more than vulnerability data.

## SecDB is the past, OSV is the future

DevFeed: [SecDB is the past, OSV is the future](<https://devfeed.tech/articles/secdb-is-the-past-osv-is-the-future-13218.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/secdb-is-the-past-osv-is-the-future>)

Published: 2026-04-09T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [chainguard containers](<https://devfeed.tech/topics/chainguard-containers.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [chainguard packages](<https://devfeed.tech/topics/chainguard-packages.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-scanners](<https://devfeed.tech/tags/chainguard-scanners.md>), [cves](<https://devfeed.tech/tags/cves.md>), [deprecated](<https://devfeed.tech/tags/deprecated.md>), [open-source-vulnerabilities](<https://devfeed.tech/tags/open-source-vulnerabilities.md>), [osv](<https://devfeed.tech/tags/osv.md>), [secdb](<https://devfeed.tech/tags/secdb.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-data](<https://devfeed.tech/tags/vulnerability-data.md>), [vulnerability-scanning](<https://devfeed.tech/tags/vulnerability-scanning.md>)

### AI overview

Chainguard is deprecating its SecDB vulnerability feed and plans to sunset it at the end of 2026. The company is moving toward the OSV schema because it supports more precise vulnerability data, including unfixed vulnerabilities and component-level advisory details.

### Source excerpt

Chainguard is deprecating SecDB in favor of OSV, delivering more accurate, granular vulnerability data and better visibility for modern software supply chains.

## Snyk's Statement on the MITRE CVEs Program Funding Update

DevFeed: [Snyk's Statement on the MITRE CVEs Program Funding Update](<https://devfeed.tech/articles/snyk-s-statement-on-the-mitre-cves-program-funding-update-8186.md>)

Original publisher: [Read original article](<https://snyk.io/blog/snyks-statement-on-the-mitre-cves-program-funding-update/>)

Author: Danny Allan

Published: 2025-04-16T04:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Resilience](<https://devfeed.tech/topics/resilience.md>), [Security & Privacy](<https://devfeed.tech/topics/security-privacy.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>)

Tags: [2025](<https://devfeed.tech/tags/2025.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [blog](<https://devfeed.tech/tags/blog.md>), [community](<https://devfeed.tech/tags/community.md>), [cves](<https://devfeed.tech/tags/cves.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [executive](<https://devfeed.tech/tags/executive.md>), [global](<https://devfeed.tech/tags/global.md>), [government](<https://devfeed.tech/tags/government.md>), [resilience](<https://devfeed.tech/tags/resilience.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk](<https://devfeed.tech/tags/snyk.md>), [snyk-platform](<https://devfeed.tech/tags/snyk-platform.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-data](<https://devfeed.tech/tags/vulnerability-data.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>), [vulnerability-scanning](<https://devfeed.tech/tags/vulnerability-scanning.md>)

### AI overview

Snyk responds to uncertainty about federal funding for MITRE's CVE program and reports that its services and vulnerability data are not immediately affected. The statement emphasizes Snyk's independently curated vulnerability database, its ability as a CVE Numbering Authority to assign CVEs, and its willingness to collaborate on sustaining vulnerability infrastructure.

### Source excerpt

Snyk addresses the recent MITRE CVE funding news, detailing our independent vulnerability data capabilities & commitment to cybersecurity resilience.

## Chainguard enhances security with OSV advisory feed

DevFeed: [Chainguard enhances security with OSV advisory feed](<https://devfeed.tech/articles/chainguard-enhances-security-with-osv-advisory-feed-12943.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/chainguard-enhances-security-with-osv-advisory-feed>)

Published: 2024-07-02T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard](<https://devfeed.tech/topics/chainguard.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Maintainers](<https://devfeed.tech/topics/maintainers.md>), [chainguard images](<https://devfeed.tech/topics/chainguard-images.md>), [data](<https://devfeed.tech/topics/data.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Google](<https://devfeed.tech/topics/google.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [google](<https://devfeed.tech/tags/google.md>), [maintainers](<https://devfeed.tech/tags/maintainers.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [open-source-vulnerabilities](<https://devfeed.tech/tags/open-source-vulnerabilities.md>), [openssf](<https://devfeed.tech/tags/openssf.md>), [osv](<https://devfeed.tech/tags/osv.md>), [secure-open-source](<https://devfeed.tech/tags/secure-open-source.md>), [secure-software](<https://devfeed.tech/tags/secure-software.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-data](<https://devfeed.tech/tags/vulnerability-data.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>), [wolfi](<https://devfeed.tech/tags/wolfi.md>)

### AI overview

Chainguard is publishing its security advisory feed in the OSV format, improving the precision and usability of vulnerability information for open source maintainers and downstream consumers.

### Source excerpt

Explore Chainguard's new OSV advisory feed, delivering comprehensive and up-to-date vulnerability information to enhance your security posture.

## Making vulnerability data better for machines (and humans!) with OpenVEX: How Isovalent and Chainguard use OpenVEX

DevFeed: [Making vulnerability data better for machines (and humans!) with OpenVEX: How Isovalent and Chainguard use OpenVEX](<https://devfeed.tech/articles/making-vulnerability-data-better-for-machines-and-humans-with-openvex-how-isovalent-and-chainguard-use-openvex-13144.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/making-vulnerability-data-better-for-machines-and-humans-with-openvex-how-isovalent-and-chainguard-use-openvex>)

Published: 2023-08-31T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [openvex](<https://devfeed.tech/topics/openvex.md>), [Security](<https://devfeed.tech/topics/security.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>)

Tags: [chainguard](<https://devfeed.tech/tags/chainguard.md>), [cve](<https://devfeed.tech/tags/cve.md>), [isovalent](<https://devfeed.tech/tags/isovalent.md>), [openvex](<https://devfeed.tech/tags/openvex.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [vulnerability-data](<https://devfeed.tech/tags/vulnerability-data.md>), [vulnerability-management](<https://devfeed.tech/tags/vulnerability-management.md>)

### AI overview

The article explains how OpenVEX, an implementation of the Vulnerability Exploitability eXchange, provides a machine-readable specification, software library, and tools for managing vulnerability data. It describes how Isovalent and Chainguard use OpenVEX to reduce fragmented manual processes and improve vulnerability handling.

### Source excerpt

Explore how Chainguard and Isovalent utilize OpenVEX to enhance vulnerability data handling for improved security.

## A purl of wisdom on SBOMs and vulnerabilities

DevFeed: [A purl of wisdom on SBOMs and vulnerabilities](<https://devfeed.tech/articles/a-purl-of-wisdom-on-sboms-and-vulnerabilities-12860.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/a-purl-of-wisdom-on-sboms-and-vulnerabilities>)

Published: 2023-02-14T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [open-source-security](<https://devfeed.tech/topics/open-source-security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>)

Tags: [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [component](<https://devfeed.tech/tags/component.md>), [components](<https://devfeed.tech/tags/components.md>), [container-images](<https://devfeed.tech/tags/container-images.md>), [false-positive](<https://devfeed.tech/tags/false-positive.md>), [nvd](<https://devfeed.tech/tags/nvd.md>), [package-url](<https://devfeed.tech/tags/package-url.md>), [purl](<https://devfeed.tech/tags/purl.md>), [sbom](<https://devfeed.tech/tags/sbom.md>), [sboms](<https://devfeed.tech/tags/sboms.md>), [scanner](<https://devfeed.tech/tags/scanner.md>), [software-bill-of-materials](<https://devfeed.tech/tags/software-bill-of-materials.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability-data](<https://devfeed.tech/tags/vulnerability-data.md>), [vulnerability-scanner](<https://devfeed.tech/tags/vulnerability-scanner.md>), [vulnerability-scanning](<https://devfeed.tech/tags/vulnerability-scanning.md>)

### AI overview

The article argues that Software Bill of Materials (SBOMs) would be more useful if the National Vulnerability Database (NVD) widely adopted the package URL (purl) naming scheme. Analysis of real scanner false positives suggests that purl information could reduce the false positive rate by more than 50%.

### Source excerpt

SBOMs could be a lot more useful if the NVD implemented widespread usage of the purl naming scheme, which could reduce the false positive rate by over 50%.