# NVD The National Vulnerability Database (NVD) is a U.S. government repository of vulnerability-management data covering software and hardware flaws, security misconfigurations, and related impact metrics. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## RBP Tracker: Counting the CVE IDs the CVE List Cannot See DevFeed: [RBP Tracker: Counting the CVE IDs the CVE List Cannot See]() Original publisher: [Read original article]() Author: jgamblin Published: 2026-09-14T14:16:42Z Content type: article Language: en Sources: [Jerry Gamblin]() Topics: [data](), [NVD](), [API](), [GitHub]() Tags: [api](), [cve](), [cve-list](), [data](), [ids](), [list](), [nvd](), [report](), [scanner](), [source](), [state](), [uncategorized]() ### AI overview The article examines a corrected RogoLabs tracker for Reserved but Public CVE IDs. It explains that the CVE Services API returns 404 for reserved IDs, while a separate unauthenticated endpoint reveals their RESERVED state. The tracker lists IDs from public advisory feeds and describes how reserved records are absent from the bulk CVE List until publication. ### Source excerpt A new RogoLabs site lists Reserved but Public CVE IDs: 2,315 of them on September 14, drawn from 17 public advisory feeds, refreshed every six hours, and held a week before they appear. The first version of this tracker reported that none of the CVE IDs it found existed in the CVE List, in any ... Read more ## Why Vulnerability Clearinghouses Alone Cannot Secure Open Source DevFeed: [Why Vulnerability Clearinghouses Alone Cannot Secure Open Source]() Original publisher: [Read original article]() Published: 2026-07-05T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [data](), [Vulnerabilities](), [Open Source](), [Security](), [NVD](), [Unix]() Tags: [akrites](), [athena](), [chainguard-libraries](), [data](), [ibm-red-hat-project-lightwell](), [nvd](), [open-source](), [press-release](), [secure-open-source](), [security](), [security-research](), [vulnerability-clearinghouse](), [vulnerability-data]() ### AI overview The article argues that vulnerability clearinghouses are primarily pools of data and are not the most important part of securing open source. It emphasizes actuation--turning findings into fixes--along with trusted builds and secure-by-design software. ### Source excerpt Clearinghouses alone won't secure open source. Learn why actuation, trusted builds, and secure-by-design software matter more than vulnerability data. ## CNAScorecard.org Measures CVE Data Quality and Completeness DevFeed: [CNAScorecard.org Measures CVE Data Quality and Completeness]() Original publisher: [Read original article]() Author: jgamblin Published: 2025-08-14T00:43:12Z Content type: opinion Language: en Sources: [Jerry Gamblin]() Topics: [Data Quality](), [Vulnerabilities](), [NVD]() Tags: [alert-fatigue](), [cve](), [cve-data](), [data-quality](), [nvd](), [uncategorized](), [vulnerabilities]() ### AI overview The article introduces CNAScorecard.org, a public scorecard intended to measure the quality and completeness of CVE data supplied by CVE Numbering Authorities. It describes missing or incomplete weakness, product, severity, and fix information as a practical vulnerability-management problem, and connects the effort to the NVD backlog. ### Source excerpt I'm incredibly excited to finally share something I've been pouring my heart into at RogoLabs. For those of you who caught my talk at BSidesLV, you got a sneak peek, but today it's official: CNAScorecard.org is live! For years, the CVE program has been our shared language for identifying vulnerabilities. But lately, we've all felt ... Read more ## Get Smart in Five Minutes: What is a CVE and why care? DevFeed: [Get Smart in Five Minutes: What is a CVE and why care?]() Original publisher: [Read original article]() Published: 2024-08-08T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Vulnerabilities](), [NVD](), [Exploit](), [exploit chaining](), [chainguard]() Tags: [chainguard](), [cve](), [cybersecurity](), [exploit](), [exploit-chaining](), [get-smart-in-five-minutes](), [nvd](), [software-supply-chain](), [software-supply-chain-security](), [updates](), [vulnerabilities]() ### AI overview This beginner-friendly article explains what Common Vulnerabilities and Exposures (CVEs) are, why their unique identifiers matter, and how they affect software supply chain security. It covers the CVE lifecycle, the role of the National Vulnerability Database, severity ratings, patching, and exploit chaining. ### Source excerpt Learn the basics of CVEs, why they matter for cybersecurity, and how to stay protected in this quick teaser of the Get Smart series by Chainguard. ## NVD updates: CVSS v4.0, CISA data, and more DevFeed: [NVD updates: CVSS v4.0, CISA data, and more]() Original publisher: [Read original article]() Published: 2024-07-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [NVD](), [vulnerability management](), [cisa](), [vulnerability](), [Cybersecurity]() Tags: [cisa](), [cvss-v4-0](), [cybersecurity](), [github](), [nvd](), [open-source](), [vulnerability](), [vulnerability-management](), [vulnrichment]() ### AI overview The article explains recent updates to the National Vulnerability Database, including its integration of CISA's Vulnrichment project and enriched CVSS and CWE data. It describes how more complete vulnerability information can help security scanners and teams prioritize and manage vulnerabilities. ### Source excerpt Learn about the NVD's recent updates, including CISA Vulnrichment data, CVSS v4.0 integration, and how they impact your vulnerability management workflow. ## Vulnerability fixes in plain sight: How your scanners are missing hundreds of vulnerabilities DevFeed: [Vulnerability fixes in plain sight: How your scanners are missing hundreds of vulnerabilities]() Original publisher: [Read original article]() Published: 2024-06-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [Security](), [chainguard](), [NVD](), [chainguard images](), [container images](), [Open Source]() Tags: [chainguard](), [chainguard-images](), [container-images](), [cve](), [cve-list](), [cves](), [nvd](), [open-source-software](), [remote-code-execution-vulnerability](), [research](), [sca](), [security](), [software-composition-analysis](), [vulnerabilities](), [vulnerability-fix](), [vulnerability-scanning](), [wolfi]() ### AI overview An analysis of more than 600 Wolfi-packaged projects found over 100 security fixes without associated CVEs. Because vulnerability scanners and SCA tools rely on vulnerability databases such as the NVD, organizations may miss fixes unless they keep software updated. ### Source excerpt Are your vulnerability scanners missing critical security flaws? Discover how Chainguard's research reveals hundreds of vulnerabilities hiding in plain sight. ## Software Bill of Materials DevFeed: [Software Bill of Materials]() Original publisher: [Read original article]() Author: John Lee Published: 2023-11-02T00:00:00Z Content type: tutorial Language: en Sources: [Blog on Developer Portal]() Topics: [software bill of materials](), [ESP-IDF](), [Espressif](), [supply-chain-security](), [NVD](), [Security]() Tags: [blog](), [esp-idf](), [esp32](), [espressif](), [iot](), [nvd](), [sbom](), [security](), [security-vulnerabilities](), [software-bill-of-materials](), [spdx](), [tools](), [vulnerabilities]() ### AI overview This article introduces software bills of materials (SBOMs), explains their structure and formats such as SPDX and CycloneDX, and presents Espressif's ESP-IDF-SBOM tool. The tool generates SPDX SBOMs for ESP-IDF-based applications and checks them against the National Vulnerability Database for known vulnerabilities. ### Source excerpt Overview# The "software bill of materials" (SBOM) has emerged as a key building block in software security and software supply chain risk management. An SBOM is a comprehensive list of all the software components, dependencies, and metadata associated with an application. Espressif believes that this information is a key step towards ensuring the security of the connected devices. And as such, we have now enabled easy to use tools and solutions to track and analyze this information. ## How "junk CVEs" can misclassify ordinary bugs as vulnerabilities DevFeed: [How "junk CVEs" can misclassify ordinary bugs as vulnerabilities]() Original publisher: [Read original article]() Published: 2023-10-17T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [chainguard images](), [Maintainers](), [NVD](), [Open Source]() Tags: [chainguard-images](), [code](), [cve](), [cves](), [developer](), [false-negative](), [false-positive](), [maintainers](), [nvd](), [open-source](), [vulnerabilities](), [vulnerability-management]() ### AI overview The article explains the concept of "junk CVEs," in which scanners report ordinary bugs as vulnerabilities. Through a fictional Halloween story, it describes how maintainers may dispute these reports and promotes Chainguard Images as a way to reduce reported vulnerabilities. ### Source excerpt Unveil 'junk CVEs' with Chainguard Images, your ally against disguised vulnerabilities, ensuring a secure codebase this Halloween. ## Fuzzy CVEs, tarfiles, and untrusted input DevFeed: [Fuzzy CVEs, tarfiles, and untrusted input]() Original publisher: [Read original article]() Published: 2023-07-27T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Cybersecurity](), [Vulnerabilities](), [common vulnerabilities and exposures](), [Python](), [Open Source](), [Maintainers](), [NVD]() Tags: [common-vulnerabilities-and-exposures](), [cve](), [cves](), [cybersecurity](), [go](), [maintainers](), [nvd](), [open-source](), [python](), [scanner](), [scanners](), [software-supply-chain](), [vulnerability-scanner](), [vulnerability-scanning](), [wolfi]() ### AI overview This article examines CVE-2007-4559 in Python's tarfile module, why the 15-year-old issue may still appear in security scanners, and why its classification as a vulnerability is disputed. It discusses CVE processes, NVD entries, open-source maintainer constraints, and the risks of extracting untrusted tarfile inputs. ### Source excerpt Navigate fuzzy CVEs, tarfiles, and untrusted input with Chainguard, paving the way to secure coding practices.