CVE in an Era of AI-Enabled Vulnerability Discovery
Protecting CVE Quality While Reducing Maintainer Burden
Jessy Ayala
Ph.D. Candidate @ University of California, Irvine
July 30, 2026
CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
The Problem: CVE × OSS Maintainer Mismatch
CVE was designed for vendors with dedicated security teams — but OSS maintainers are volunteer-driven, resource-constrained, and without formal security training.
CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
The Problem: CVE × OSS Maintainer Mismatch
CVE was designed for vendors with dedicated security teams — but OSS maintainers are volunteer-driven, resource-constrained, and without formal security training.
Research Findings
#1
Challenge
"Producing fixes"
#1
Usability Barrier
"Lacking project context"
#1
Listed Want
"Assessment support"
CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
The Problem: CVE × OSS Maintainer Mismatch
CVE was designed for vendors with dedicated security teams — but OSS maintainers are volunteer-driven, resource-constrained, and without formal security training.
Research Findings
#1
Challenge
"Producing fixes"
#1
Usability Barrier
"Lacking project context"
#1
Listed Want
"Assessment support"
CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
Overarching theme: Security actionability
AI Is Accelerating the Crisis
AI-generated ("slop") bug bounty reports amplify every maintainer challenge:
CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
AI Is Accelerating the Crisis
AI-generated ("slop") bug bounty reports amplify every maintainer challenge:
<5%
cURL bug bounty validity rate
(shut down Jan 2026)
warning
Google OSS VRP
warned against AI submissions
CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
2×
HackerOne submissions
doubled YoY (April 2026)
~47,000 reports in March 2026 alone
AI Is Accelerating the Crisis
AI-generated ("slop") bug bounty reports amplify every maintainer challenge:
CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
Introducing MINT
Maintainer INformed Triage Framework
A modular pipeline that cross-checks vulnerability reports against the target repository before they enter the CVE Lifecycle.
Design Concept: Iterative, community-informed, serving real-world developer triage workflows.
CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
Introducing MINT
Maintainer INformed Triage Framework
A modular pipeline that cross-checks vulnerability reports against the target repository before they enter the CVE Lifecycle.
Framework Goals
01
Reduce Burden
Minimize manual overhead and stress for maintainers during triage.
02
Filter Early
Prevent low-quality/AI-slop propagation before entering CVE lifecycle.
CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
Design Concept: Iterative, community-informed, serving real-world developer triage workflows.
Introducing MINT
Maintainer INformed Triage Framework
A modular pipeline that cross-checks vulnerability reports against the target repository before they enter the CVE Lifecycle.
Framework Goals
01
Reduce Burden
Minimize manual overhead and stress for maintainers during triage.
02
Filter Early
Prevent low-quality/AI-slop propagation before entering CVE lifecycle.
Key Pipeline Capabilities
check_circle Artifact Verification
Verifies referenced artifacts (files, functions, paths) actually exist.
check_circle Quality Assessment
Assesses vulnerability report quality and practical actionability.
check_circle Severity Analysis
Questions possible severity inflation in submissions.
check_circle Maintainer Triage Briefs
Produces clean, maintainer-facing summary briefs.
CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
Design Concept: Iterative, community-informed, serving real-world developer triage workflows.
Call to Action: We Need Your Help
Ask #1 — Data
Soliciting real-world AI-slop submissions, low-quality reports, high-quality reports…
From OSS maintainers to build a benchmark dataset (legitimate + low-quality + valid reports)
Sources: OSS bug bounty programs, publicly disclosed AI slop (e.g., cURL collection)
CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
Call to Action: We Need Your Help
Ask #1 — Data
Soliciting real-world AI-slop submissions, low-quality reports, high-quality reports…
From OSS maintainers to build a benchmark dataset (legitimate + low-quality + valid reports)
Sources: OSS bug bounty programs, publicly disclosed AI slop (e.g., cURL collection)
Ask #2 — Feedback
CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
Call to Action: We Need Your Help
Ask #1 — Data
Soliciting real-world AI-slop submissions, low-quality reports, high-quality reports…
From OSS maintainers to build a benchmark dataset (legitimate + low-quality + valid reports)
Sources: OSS bug bounty programs, publicly disclosed AI slop (e.g., cURL collection)
Ask #2 — Feedback
Takeaway: Quality gates early in the CVE Record Lifecycle is adoptable without major changes.
CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
Thank You!
code
GitHub
@jayala-29
CVE is sponsored by U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
Jessy Ayala
Ph.D. Candidate @ University of California, Irvine