CVE/FIRST VulnCon 2026 & Annual CNA Summit
The vulnerability management ecosystem conference co-hosted by FIRST and the CVE Program, with the Annual CNA Summit: NVD and CVE quality, CSAF and VEX, SBOMs and AIBOMs, vulnerability matching and identity, CVSS and exploit prediction, supply chain malware, and AI in vulnerability triage.
→ See editor’s top picks at CVE/FIRST VulnCon 2026 & Annual CNA Summit
- NIST’s National Vulnerability Database Update and the Vulnerability Enrichment Ecosystem — Harold Booth
Harold Booth from the National Institute of Standards and Technology (NIST) delivered a critical update on the state of the National Vulnerability Database (NVD) and its evolving role within the…
- Lessons From NPM's Dark Side: Preventing the Next Shai-Hulud — Jenn Gile
In this compelling talk at VulnCon, Jenn Gile, co-founder of opensourcemalware.com, illuminated the escalating threat of intentionally malicious packages within the Node Package Manager (NPM)…
- Three Musketeers: CVE, CSAF, and VEX — Eoin Wilson-Manion, Tyler Zellers, Jonathan Spring
This talk, "Three Musketeers: CVE, CSAF, and VEX," delivered by Eoin Wilson-Manion and Tyler Zellers from Tharros Labs, alongside Jonathan Spring from CISA, delves into the critical role of…
- Panel: CVE Record Disputes Discussion: Policy, Process, and Opportunities for Improvement — Alec Summers, Yogesh Mittal, Lisa Olson, Lindsey Cerkovnik, Jimmy Calderon
The Common Vulnerabilities and Exposures (CVE) program serves as the cornerstone for identifying and cataloging cybersecurity vulnerabilities, providing a standardized identifier (CVE ID) for each…
- Mind the Match: Why Vulnerability Matching Is Harder Than You Think — Alexandra Selldorff
In her VulnCon talk, "Mind the Match: Why Vulnerability Matching Is Harder Than You Think," Alexandra Selldorff of Manifest Cyber dissects the often-overlooked complexities and inherent challenges…
- How to Answer “What’s Affected?” in Open Source — Jess Lowe, Rex Pan
In an era of exponentially increasing software vulnerabilities, accurately identifying "what's affected" in open-source projects has become a critical, yet often elusive, challenge. Jess Lowe and…
- Preparing Vulnerability Management for the Post-Quantum Era: From Legacy Cryptography Crypto-Agility — Arun Singh
Arun Singh, a Security Research Engineer at Qualys, delivered a critical talk at VulnCon addressing the looming threat of quantum computing to our current cryptographic infrastructure. His…
- Flipping the Criticality Funnel, A Practical Path to Real Prioritization — Sophia Sanles-Luksetich, Zachary Goldman
In the fast-paced world of cybersecurity, effective vulnerability management hinges on accurate prioritization. However, as Sophia Sanles-Luksetich and Zachary Goldman from GitHub demonstrated at…
- The CVE Program Quality Era: Strengthening Trust and Impact In Global Vulnerability Data — Lindsey Cerkovnik, Alec Summers
In an insightful and forward-looking presentation at VulnCon, Lindsey Cerkovnik from CISA and Alec Summers from The MITRE Corporation unveiled the strategic direction for the Common Vulnerabilities…
- From JSON to Clarity: Practical Tools for SBOM Interpretation — John Bergland, Zadia Alden
In the realm of software supply chain security, Software Bill of Materials (SBOMs) have emerged as a critical artifact, mandated by executive orders and regulations like the Cyber Resilience Act…
- Contextual SBOMs: Unlocking Precise Vulnerability Management with Build-Time Content Intelligence — Przemyslaw "Rogue" Roguski
In the rapidly evolving landscape of software supply chain security, Software Bill of Materials (SBOMs) have emerged as a foundational element for transparency and risk management. However, as…
- Vulnrichment Playground — Art Manion, Lindsey Cerkovnik
The "Vulnrichment Playground" talk at VulnCon, presented by Lindsey Cerkovnik, Chief of Vulnerability Response and Coordination at CISA, and Art Manion from Tharros Labs, delved into CISA's efforts…
- CVE Record Format - Purl and CPE Workshop — Chris Coffin, MZ MegaZone
In a detailed session at VulnCon, Chris Coffin from MITRE and MZ MegaZone from F5, both co-chairs of the CVE Quality Working Group, illuminated significant enhancements to the CVE record format…
- Operationalizing AIBOMs: Extending Vulnerability Management to AI Models and Datasets — Alexandra Selldorff, Ugur Koc
In an era where Artificial Intelligence (AI) has become a ubiquitous production dependency across virtually all digital products and workflows, the security landscape for these systems remains…
- Identifying Exploited and Likely-to-Be-Exploited Vulnerabilities — Patrick Garrity, Wade Sparks
In this insightful VulnCon talk, Patrick Garrity and Wade Sparks from VulnCheck delve into their comprehensive strategies for identifying vulnerabilities that are actively exploited in the wild or…
- The Dependency Mirage: Hidden Vulnerabilities in Your Compiled Binaries — Craig Heffner, Peter Eacmen
In "The Dependency Mirage: Hidden Vulnerabilities in Your Compiled Binaries," Craig Heffner and Peter Eacmen from NetRise shed light on a critical, yet often overlooked, aspect of software supply…
- Automating CNA CVE Reporting and Monthly Bulletins at Atlassian — Deepak Chintala, Zachary Echouafni
In an era where software supply chain security and transparent vulnerability disclosure are paramount, Atlassian, a major enterprise software provider, has transformed its Common Vulnerabilities and…
- Stepping up the ENISA's role in Support of EU Vulnerability Services — Johannes Kaspar Clos
In this insightful talk from VulnCon, Johannes Kaspar Clos from the European Union Agency for Cybersecurity (ENISA) outlined the agency's rapidly expanding mandate and strategic initiatives aimed at…
- Embracing the Era of Transparency: Automating VEX Application for Scalable, Context-Aware Security — Jessica Butler, Kristina Joos
In an era increasingly defined by software supply chain complexities, the challenge of effectively communicating vulnerability exploitability information to consumers remains a significant hurdle…
- The Vulnerability Ecosystem’s Vendor Bias — Exposed by Open Source — Pete Allor, Yogesh Mittal
In a critical presentation at VulnCon, Pete Allor and Yogesh Mittal illuminated a fundamental flaw in the global vulnerability ecosystem: its inherent bias towards traditional, centralized vendors…
- Panel: The CVE Supplier ADP (SADP) Pilot: Am I Affected byUpstream? — Art Manion, Jeremy Daigneau, Lisa Olson, Yogesh Mittal
In the complex landscape of modern software development, where applications are increasingly composed of numerous third-party and open-source components, understanding the true impact of an upstream…
- The Hidden Cost of CVEs: Can CSAF and VEX Change the Equation? — Lisa Olson
In an era defined by an ever-accelerating pace of software development and a corresponding surge in discovered vulnerabilities, the traditional mechanisms for managing and communicating security…
- A Paradigm Shift in Vulnerability Identity: Why Vulnerability Databases Struggle — Art Manion, Jay Jacobs
In this thought-provoking talk at VulnCon, Art Manion and Jay Jacobs present a radical re-evaluation of how the cybersecurity industry approaches vulnerability identification and management. They…
- CVE Decaf: Brewing Better and More Actionable Data Quality — Jerry Gamblin, Jay Jacobs
In "CVE Decaf: Brewing Better and More Actionable Data Quality," Jerry Gamblin from Cisco and Jay Jacobs from Empirical Security address a critical and growing challenge facing the cybersecurity…
- Axiomatic Events that Evolved Vulnerability Databases — Johnny Shaieb
In his compelling VulnCon presentation, "Axiomatic Events that Evolved Vulnerability Databases," Johnny Shaieb, a PhD student at the University of Tulsa and Global Delivery Leader of Vulnerability…
- Supply Chains and Malware Campaigns: Is CVE the Right Way to Name the Game? — Art Manion, Caitlin Condon, David Welch, Shelby Cunningham
In an era increasingly defined by complex software supply chains and sophisticated cyberattacks, a critical question looms over the cybersecurity community: Is the established Common Vulnerabilities…
- Fragile by Design: Large-Scale Evidence of Supply Chain Risk — Gary Schwartz
In his compelling VulnCon talk, "Fragile by Design: Large-Scale Evidence of Supply Chain Risk," Gary Schwartz of NetRise delivered a sobering assessment of the systemic issues plaguing software…
- The Myth of the Meteoric Rise in Vulnerabilities — Scott Moore
In his compelling VulnCon talk, "The Myth of the Meteoric Rise in Vulnerabilities," Scott Moore of VulnCheck challenges the prevailing narrative that the number of security vulnerabilities is…
- AI Systems Are Software Systems — Jonathan Spring
In an era saturated with discussions about artificial intelligence, Jonathan Spring of CISA (Cybersecurity and Infrastructure Security Agency) delivered a pivotal talk at VulnCon titled "AI Systems…
- National CSIRT as a CVD Hub: Lessons from CERT.PL’s Vulnerability Coordination Cases — Michał Dondajewski
In this insightful VulnCon presentation, Michał Dondajewski, a CVD Coordination Specialist at CERT.PL, shares the unique experiences and challenges faced by Poland's national Computer Emergency…
- Speeding Up Vulnerability Triage: Automating Context Retrieval with AI Agents — Jorge Gimenez
In the contemporary cybersecurity landscape, vulnerability management teams are frequently overwhelmed by a deluge of alerts from various scanning tools, leading to significant challenges in…
- Deriving CVSS from Multi-Scenario Attack Graphs: A Reproducible, Auditable Scoring Method — Karel Knibbe, Ruben Bos
In an era where the volume of published vulnerabilities is skyrocketing—with projections from First Forecast estimating 100,000 new vulnerabilities this year alone—the traditional, manual approach…
- Diving into the CVSS Base Score Metrics - An Exploratory Analysis Bridging Product Security... — Kohei Taguchi, Takayuki Uchiyama, Yuichi Kikuchi
This talk, presented by Kohei Taguchi, Takayuki Uchiyama, and Yuichi Kikuchi from Panasonic Holdings Corporation, delves into a critical challenge faced by product manufacturers: effectively…
- Accuracy Is Not Enough: Detecting Hidden Risk in CVE Impact Prediction — Keerthana Purushotham
In the dynamic landscape of cybersecurity, accurately assessing the impact of Common Vulnerabilities and Exposures (CVEs) is paramount for effective risk management. However, traditional reliance on…
- Taming the Scanner Storm: How VEX Brings Context to Vulnerability Data — Jessica Butler
In the modern software supply chain, organizations face an overwhelming deluge of vulnerability data, often referred to as a "scanner storm." This talk, presented by Jessica Butler from NVIDIA…
- Organizational Context Matters: Security Control Effectiveness on Vulnerabilities for Prioritization — Ertugrul Yaprak, Mehmet Kiliç
In an era defined by an ever-increasing deluge of vulnerabilities, security teams are perpetually overwhelmed, struggling to prioritize and remediate threats effectively. Mehmet Kiliç and Ertugrul…
- The Quality Era of CVE: A Blueprint for Global Software Safety — Bob Lord
In his compelling VulnCon talk, "The Quality Era of CVE: A Blueprint for Global Software Safety," Bob Lord challenges the cybersecurity community to fundamentally rethink the Common Vulnerabilities…
- The AI Arms Race in Vulnerability Management, Who’s Winning? — Yotam Perkal
In his compelling VulnCon talk, "The AI Arms Race in Vulnerability Management, Who’s Winning?", Yotam Perkal, Security Research Lead at Pluto Security, delves into the escalating competition between…
- Boosting Vulnerability Intelligence: How Accurate CWE Mappings Transform ML Model Performance — David Starobinski, Sevval Simsek, Varsha Athreya
In the realm of cybersecurity, the accuracy and depth of vulnerability intelligence are paramount for effective defense. This talk, presented by David Starobinski, Sevval Simsek, and Varsha Athreya…
- Quantifying Swiss Cheese, the Bayesian Way — Stephen Shaffer
Stephen Shaffer, an engineer at Moderna and co-chair of the EPSS Special Interest Group, presented a compelling and ambitious vision for a quantified vulnerability risk model in his VulnCon talk…
- AI Is Writing Your Bug Reports. Can You Tell? — Khushali Dalal
In an era where artificial intelligence increasingly permeates every facet of technology, its impact on vulnerability management and bug bounty programs has become a critical concern. Khushali…
- The Weaponization Gap: What 20 Million KEV Detections Reveal About Edge Remediation — Saeed Abbasi
This VulnCon talk, "The Weaponization Gap: What 20 Million KEV Detections Reveal About Edge Remediation," delivered by Saeed Abbasi, Senior Manager of Security Research at Qualys Threat Research…
- Saving Ourselves the ID Headache: How Purls Can Work for Models and Datasets — Daniel Bardenstein
In a critical address at VulnCon, Daniel Bardenstein, CEO and co-founder of Manifest Cyber, illuminated a rapidly escalating challenge in modern cybersecurity: the lack of standardized…
- Remediation-Aware Reachability: Patching Containers, Prioritizing with Agentic-CTI, and Scaling... — Francesco Cipollone
In an era defined by the relentless acceleration of cyber threats and the pervasive influence of artificial intelligence, traditional vulnerability management (VM) programs are struggling to keep…
- The CVE Blind Spot: Defeating "Hidden EOLs" and Repo Jacking with Engineering Triage & Code Diet — Kota Kanbe, Ryunosuke Tanai
In an era of increasing software supply chain attacks, traditional vulnerability management approaches often fall short. This talk, delivered by Ryunosuke Tanai and Kota Kanbe of Future Corporation…
- Transforming Vulnerability Management with Advanced Dependency Knowledge Graphs — David Starobinski, Sevval Simsek
In an era defined by increasingly complex software supply chains, understanding and mitigating vulnerabilities has become a paramount challenge. The talk, "Transforming Vulnerability Management with…
- Production Is the New Attack Surface: Why Post-Deployment Endpoint Detection Is Now Critical — Tracy Ragan
In a compelling presentation at VulnCon, Tracy Ragan, co-founder of DeployHub.com, challenged the security community to fundamentally rethink its approach to protecting live production environments…
- Vulnerabilities Without CVEs: Governing the Dark Matter of Internal and Unknown Software — Josh Skorich
In the realm of cybersecurity, traditional vulnerability management (VM) programs often operate under a critical blind spot: the vast expanse of software that exists without a publicly recognized…
- From Roadmap to Results: Measuring CWE Adoption to Enable Prevention — Alec Summers, Steve Christey Coley
This talk, presented by Alec Summers and Steve Christey Coley of The MITRE Corporation at VulnCon, provides a comprehensive update on the advancements and strategic direction of the Common Weakness…
- CISA-ENISA Joint Messaging — Lindsey Cerkovnik, Nuno Rodrigues Carvalho
In a pivotal address at VulnCon, representatives from the US Cybersecurity and Infrastructure Security Agency (CISA) and the European Union Agency for Cybersecurity (ENISA) outlined a shared vision…