I took the morning off yesterday for personal reasons and so didn’t publish a news pod (and I hope you enjoyed the interview with Peter Kujawa diving into compensation.
And this first story managed to play out entirely in that time.
The U.S. government’s funding for the Common Vulnerabilities and Exposures program, a critical database for tracking security flaws, was set to expire on April 16. Established 25 years ago, the program assigns unique identifiers to security vulnerabilities, enabling consistent communication across the cybersecurity landscape. Without renewed funding, experts warned that new vulnerabilities may go untracked, risking national security and critical infrastructure.
This funding loss coincides with expected budget cuts at the Cybersecurity and Infrastructure Security Agency, which partners with MITRE on the program. The US government indicated it would not renew the contract with MITRE.
In response, two key initiatives emerged: the CVE Foundation, a new non-profit aimed at ensuring the program’s independence, and the Global CVE Allocation System, a decentralized platform introduced by the European Union. The CVE Foundation was launched on April 16, 2025, to eliminate reliance on government funding and promote global collaboration, emphasizing the need for a sustainable model. Meanwhile, the Global CVE Allocation System empowers independent authorities to assign vulnerability identifiers, enhancing flexibility and scalability.
The Trump administration then decided to continue funding the Common Vulnerabilities and Exposures program, ensuring no interruption in its critical cybersecurity services. The U.S. Cybersecurity and Infrastructure Agency confirmed that it executed the contract option to maintain these services. The CVE Foundation, which aims to transition the program into a nonprofit entity, has yet to clarify its future now that government support has been renewed.
Why do we care?
This story highlights a real-time stress test of our cybersecurity ecosystem’s foundational dependencies—and shows how close we came to a major fracture.
The CVE system is essential plumbing for the cybersecurity industry. If vulnerability disclosures become inconsistent, fragmented, or stalled, the entire patch management and threat intelligence pipeline slows or breaks.
The whiplash in this story—from defunding to renewed government support in a matter of hours—should concern every operator. It shows how politically fragile critical infrastructure funding has become, even when tied to national security.
If there is any upside, it’s that this could be the start of a more globally inclusive, resilient vulnerability ecosystem. The risk? We break something in the transition.