You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Description
In OpenCVEv1 the notification setting for "a new CVE is created" would only provide notifications when a new CVE was published, not updated, which is the desired behavior. The current notification system includes an option to receive alerts for "a new CVE is created," as shown in the screenshot, however it appears that every CVE, even newly created ones, get classified as "updated." In order to work around this you have to select "one or more subscriptions first appeared in a CVE" or other settings in order to get notifications. This results in users receiving notifications for updates to all CVEs, including older ones, instead of strictly notifications for newly published CVEs.
Impact
This behavior dilutes the effectiveness of the "new CVE created" notification setting because:
Users are overwhelmed by notifications for older CVEs marked as "updated."
The purpose of tracking newly published CVEs is lost in the noise of irrelevant updates.
Expected Behavior
The "a new CVE is created" option should strictly notify users of newly created CVEs, not those marked as updated.
Updated CVEs should remain tied to the "CVE is updated" notification options, such as changes to metrics, CPEs, or other attributes.
Steps to Reproduce
Enable the "a new CVE is created" notification option.
Wait for new CVEs to be published.
See that no notifications are sent.
Proposed Solution
Clearly distinguish between "newly created CVEs" and "updated CVEs" in the system logic.
Ensure that "a new CVE is created" notifications are only triggered for CVEs published for the first time.
Notification Setting:
New CVE Published today as "Changed"
The text was updated successfully, but these errors were encountered:
I believe an issue with this is as well that not all newly created CVEs will have a score assigned to it already. So you will miss items without a score.
Description
In OpenCVEv1 the notification setting for "a new CVE is created" would only provide notifications when a new CVE was published, not updated, which is the desired behavior. The current notification system includes an option to receive alerts for "a new CVE is created," as shown in the screenshot, however it appears that every CVE, even newly created ones, get classified as "updated." In order to work around this you have to select "one or more subscriptions first appeared in a CVE" or other settings in order to get notifications. This results in users receiving notifications for updates to all CVEs, including older ones, instead of strictly notifications for newly published CVEs.
Impact
This behavior dilutes the effectiveness of the "new CVE created" notification setting because:
Users are overwhelmed by notifications for older CVEs marked as "updated."
The purpose of tracking newly published CVEs is lost in the noise of irrelevant updates.
Expected Behavior
The "a new CVE is created" option should strictly notify users of newly created CVEs, not those marked as updated.
Updated CVEs should remain tied to the "CVE is updated" notification options, such as changes to metrics, CPEs, or other attributes.
Steps to Reproduce
Enable the "a new CVE is created" notification option.
Wait for new CVEs to be published.
See that no notifications are sent.
Proposed Solution
Clearly distinguish between "newly created CVEs" and "updated CVEs" in the system logic.
Ensure that "a new CVE is created" notifications are only triggered for CVEs published for the first time.
Notification Setting:
New CVE Published today as "Changed"
The text was updated successfully, but these errors were encountered: