Tootfinder

GCVE BCP-02 v1.9: Making Coordinated Vulnerability Disclosure Open, Accessible, and Practical for Everyone
The GCVE initiative has published version 1.9 of GCVE BCP-02 . Practical Guide to Vulnerability Handling and Disclosure, introducing significant improvements to help software vendors, manufacturers, open-source maintainers, and security researchers establish effective Coordinated Vulnerability Disclosure (CVD) processes.
Coordinated Vulnerability Disclosure should not be a privilege reserved for large organizations with dedicated security teams, expensive compliance frameworks, or specialized legal departments. Every software developer and manufacturer, regardless of size or resources, should be able to receive, assess, remediate, and disclose security vulnerabilities responsibly. This is one of the fundamental principles behind GCVE BCP-02.
The updated document is freely available, openly developed, and distributed under the Creative Commons Attribution 4.0 (CC BY 4.0) license. Organizations can reuse, adapt, and integrate its recommendations into their own vulnerability-handling processes.
#cra #cve #gcve #vulnerability #cvd #vulnerabilityManagement
🔗 https://gcve.eu/2026/10/16/gcve-bcp-02-v1.9-making-coordinated-vulnerability-disclosure-open-accessible-and-practical-for-everyone/

Tired of drafting vulnerability advisories from Git patches?
We developed patch2vuln to facilitate the creation of security advisories directly from Git patches.
With a single command, patch2vuln can assist an analyst throughout the advisory creation process: analyzing the patch, drafting the vulnerability title and description, identifying CWE and CAPEC mappings, proposing a CVSS v4.0 vector, extracting affected versions, remediation information and credits, and generating a structured CVE/GCVE record.
The analysis can run entirely locally using an LLM via Ollama, while deterministic processing is used for elements such as CVSS scoring and structured output validation.
The goal is not to replace the security analyst, but to remove much of the repetitive work and provide a solid structured draft for human review and publication.
patch2vuln v1.0 is now available as open-source software under the @… Lab initiative.
#VulnerabilityManagement #CVD #CVE #GCVE #OpenSource #CyberSecurity #AI