Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

"New CVE Created" Notifications Trigger for Updated CVEs #500

Open
cmart1045 opened this issue Jan 9, 2025 · 1 comment
Open

"New CVE Created" Notifications Trigger for Updated CVEs #500

cmart1045 opened this issue Jan 9, 2025 · 1 comment

Comments

@cmart1045
Copy link

Description
In OpenCVEv1 the notification setting for "a new CVE is created" would only provide notifications when a new CVE was published, not updated, which is the desired behavior. The current notification system includes an option to receive alerts for "a new CVE is created," as shown in the screenshot, however it appears that every CVE, even newly created ones, get classified as "updated." In order to work around this you have to select "one or more subscriptions first appeared in a CVE" or other settings in order to get notifications. This results in users receiving notifications for updates to all CVEs, including older ones, instead of strictly notifications for newly published CVEs.

Impact
This behavior dilutes the effectiveness of the "new CVE created" notification setting because:

Users are overwhelmed by notifications for older CVEs marked as "updated."
The purpose of tracking newly published CVEs is lost in the noise of irrelevant updates.

Expected Behavior
The "a new CVE is created" option should strictly notify users of newly created CVEs, not those marked as updated.
Updated CVEs should remain tied to the "CVE is updated" notification options, such as changes to metrics, CPEs, or other attributes.

Steps to Reproduce
Enable the "a new CVE is created" notification option.
Wait for new CVEs to be published.
See that no notifications are sent.

Proposed Solution
Clearly distinguish between "newly created CVEs" and "updated CVEs" in the system logic.
Ensure that "a new CVE is created" notifications are only triggered for CVEs published for the first time.

Notification Setting:
image

New CVE Published today as "Changed"
image

@RolphH
Copy link

RolphH commented Jan 10, 2025

I believe an issue with this is as well that not all newly created CVEs will have a score assigned to it already. So you will miss items without a score.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants