opencve VS cvelistV5

Don't like someone else running it? No problem, it's open source and you can run it yourself https://github.com/opencve/opencve

I use https://www.opencve.io you can make a account and then subscribe to different products and/or vendors to get automated updates via mail if there are new vulnerabilities that affect these products

www.opencve.io and filter on your vendors and hw models.

Check out OpenCVE, I find it as an excellent tool.

https://www.opencve.io/ - Site that allows you to be emailed of new CVEs by subscribing to different products and vendors.

https://www.opencve.io/ is something to use as well.

We, as an industry, didn't stop shipping bugs. (Small example: https://github.com/CVEProject/cvelistV5/releases)

And that thorough code review prevents bugs is, at best, a debatable assertion. See e.g. https://www.microsoft.com/en-us/research/publication/code-re...

It finds _some_ bugs. CI/CD, and a massive investment in automated testing has probably had the largest impact in moving software quality forward. (See e.g. "Accelerate", Forsgren, Humble & Kim)

Code review is an excellent tool to socialize knowledge and train up more junior engineers, but in terms of preventing bugs, it's low-value.

There seems to be new repository in a new JSON format: https://github.com/CVEProject/cvelistV5

Meanwhile, over here, I just stare at https://github.com/CVEProject/cvelistV5 and mumble "any reasonable dev, front of mind".

The issues I filed in the cvelistV5 repo are also unanswered, so I guess nobody gives a damn.

118955 entries don't even have an affected vendor/product software field, and neither with a valid version string and/or condition. They only contain plaintext descriptions and no version matching field either. Filed an issue here about it.