cybersecurity A field note by Vikrant Sharma
CVE Tracker shows how broken vulnerability disclosure is
A new minimal CVE tracker exposes the NVD's latency problem. When security teams wait weeks for severity scores, attackers do not.
Someone built a minimal CVE tracker that strips away the NVD bloat and just shows you the raw CVE data. The interesting part is not the interface. It is what the interface reveals about how slow the official system is. CVEs get published to the official feed, but the NVD takes days or weeks to assign severity scores. That gap is the problem. Security teams wait for the CVSS score before they prioritise patching. Attackers read the CVE, reverse-engineer the patch, and move. I ran into this gap at AT SecurDI when a client asked why we flagged a vulnerability before the NVD scoring appeared. We were parsing CVEs directly and writing detections based on the description, not waiting for someone to score it. That three-day lag between CVE publication and NVD enrichment is enough time for exploitation in the wild. The tracker does one thing well. It shows you what got published today, stripped of commentary. No write-ups, no vendor analysis, just the identifier and the description. That is useful for writing detection rules early, before the NVD assigns a 9.8 and every vendor scrambles. The lesson is that severity scores are lagging indicators. If you wait for them, you are already behind. Read the CVE description, assess impact based on your environment, patch or monitor accordingly. The score will arrive eventually, but the exploit will not wait.
Source: CVE Tracker
