Yeah, this was going to happen regardless of the US.

> The European Union Agency for Cybersecurity (ENISA) first announced the project in June 2024 under a mandate from the EU's Network and Information Security 2 Directive, and quietly rolled out a limited-access beta version last month during a period of uncertainty surrounding the United States' Common Vulnerabilities and Exposures (CVE) program.

Quite so. I would love to see an open sourced CVE database. It is for the public, it should be by the public.

What do you mean? A government service is a public service, by any conventional use of the term. Public/private is orthogonal to open source.

Community-maintained might be a better phrasing.

There's no particular reason a vulnerability database needs to be government-sponsored, and some compelling reasons why it shouldn't be "owned" by one government or another (one being guaranteed continuity even during seasons of change).

Well it certainly did falter (but not cease) due to incompetent leadership and guidance. We are seeing it throughout the government because the primary goal of this administration is to dismantle so that it can be reformed for their benefit.

It's more of a "break fast and move things" approach.

Nothing broke beyond perception. It’s still operating roughly as before right?

Yes, but who in industry is going to expect it to be there in the future given what the current administration is doing?

MITRE could just take the existing database and pass a hat around to industry and keep the current program going.

I will defer to your expertise in that regard, but the company I work for definitely wouldn't pony up in that scenario.

They won't need to. Microsoft or Google could fund it with pocket change. Much bigger projects than the NVD are open and funded by industry.