Create 2025-Q3-VD-WG.md #515
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Madison Oliver <[email protected]>
gkunz
reviewed
Sep 2, 2025
|
|
||
| ## Overview | ||
|
|
||
| The Vulnerability Disclosures WG is actively engaged in improving the overall security of the OSS ecosystem by advancing vulnerability reporting and communication. Our community continues to see consistent engagement, with new contributors joining recent calls from organizations like Microsoft, OWASP, and Erlang Ecosystem Foundation, indicating a healthy and growing interest. Latest news includes ongoing efforts to clarify CVE publication for unreleased software and to better integrate VEX into vulnerability management. |
Contributor
There was a problem hiding this comment.
@taladrane: on the topic of VEX, is the group planning to evolve/graduate OpenVEX?
steiza
approved these changes
Sep 4, 2025
marcelamelara
approved these changes
Sep 9, 2025
Contributor
marcelamelara
left a comment
marcelamelara
left a comment
There was a problem hiding this comment.
Thanks @taladrane !
| * **Purpose:** To explore and support the development of a global platform for vulnerability intelligence, aiming to provide a more federated and comprehensive approach to vulnerability reporting and data sharing. This initiative seeks to address current challenges in obtaining all vulnerability details from disparate sources and to foster better coordination across the industry. | ||
| * **Current Status:** A dedicated group is forming around this initiative (https://github.com/ossf/wg-vulnerability-disclosures/issues/162), with an open planning meeting already held to discuss initial requirements and gather input. Reference materials have been shared, and there's active discussion regarding recent developments around the CVE Foundation, the potential emergence of the EU MVD, and the desire for a more unified global approach. The working group has concluded that it will support this work. | ||
| * **Up Next:** The group plans to continue regular meetings to define the initial requirements for the platform. There's also an intention to invite GCVE (Global Cyber Vulnerability Economy) representatives to a WG meeting to foster cooperation and alignment with entities working on similar problems, such as the National CERT of Luxembourg. | ||
| * **Questions/Issues for the TAC:** We believe a common API and a standardized way to disclose reports are crucial for effective global vulnerability intelligence. We would appreciate the TAC's support in advocating for such common standards and exploring ways to encourage broader adoption. |
Contributor
There was a problem hiding this comment.
The Global Cyber Policy and/or ORBIT WGs could possibly offer support here as well.
bobcallaway
approved these changes
Oct 6, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Working Group Activities and Updates:
Vulnerability Reporting Improvements:
Global Coordination Initiatives: