CVE database lag caught me off guard this week

I was patching a Redis instance and checked the CVE feed, but the published date was 3 days behind what the vendor already fixed. Turns out NVD has a known backlog, I found a GitHub issue tracking it from February. Anyone else cross-check vendor advisories first because of this lag?

1 comments

1 Comment

miles24414d ago

MITRE's CVE list has the same lag, but their API at least shows vendor-reported dates so I cross-check there first.