GCVE Workshop Before Vulnopticon 2026 – Slides and Materials
On 22 September 2026, the GCVE community held a workshop in the context of Vulnopticon 2026. The workshop brought together discussions around decentralized vulnerability identification, Coordinated Vulnerability Disclosure (CVD), vulnerability data sovereignty, open-source tooling, automation, and the role of AI in the vulnerability ecosystem.
The workshop was also an opportunity to present the current state of the GCVE ecosystem, demonstrate practical use cases, and discuss the next steps for its technical and community development.
All presentation materials from the workshop are now publicly available.
Workshop presentations
The afternoon was organized around five sessions covering the different layers of the GCVE ecosystem:
-
14:00–15:00 — Introduction to GCVE: A Decentralized Approach to Vulnerability Allocation, Publishing and Management Download the slides (PDF)
-
15:00–16:00 — Digital Sovereignty Starts with Vulnerability Data — or How the Vulnerability-Lookup Stack Supports a CVD Program Download the slides (PDF)
-
16:00–16:15 — Vulniverse: A Modular Editor for Vulnerability Records Download the slides (PDF)
-
16:15–17:00 — The AI Paradox in the Vulnerability Ecosystem — GCVE Approaches Download the slides (PDF)
-
17:00–18:00 — Next Steps and Future of GCVE Download the slides (PDF)
The sessions covered both the principles behind GCVE and concrete implementations: decentralized allocation, federated publication, interoperability, collaborative vulnerability management, open-source tooling, AI-assisted workflows, and ways to improve existing CVD processes without depending on a single centralized infrastructure.
GCVE resources
For readers discovering GCVE through the workshop, the main entry points are:
Public services
Several of the components demonstrated during the workshop are publicly accessible:
- db.gcve.eu — public GCVE Vulnerability-Lookup instance
- vulnerability.circl.lu — CIRCL’s public Vulnerability-Lookup instance with open registration
- cpe.gcve.eu — collaborative CPE viewer and editor
The source code of Vulnerability-Lookup is also freely available:
Examples presented during the workshop
A significant part of the workshop was dedicated to practical examples illustrating situations encountered in real-world vulnerability management.
Expressing relationships between vulnerability records
GCVE-BCP-05 allows relationships between vulnerability records to be explicitly represented instead of forcing every record to be considered independently.
The relationship model is described in:
Examples discussed during the workshop included:
- Opposes — GCVE-1-2025-0032
- Related / overlap — GCVE-1-2026-0015
These relationships help preserve information that can otherwise be lost when vulnerability records from different producers describe, contradict, overlap with, or complement one another.
Vulnerability bundles and granularity
Another example highlighted the difficulties created when multiple vulnerabilities are grouped into a single record.
The following Cisco record was used during the workshop as an example:
Such cases raise practical questions about vulnerability granularity, references, downstream processing, and how consumers can reason about individual security issues contained within a broader record.
patch2vuln: from a Git patch to a vulnerability advisory
The workshop also demonstrated patch2vuln, an experimental open-source tool developed in the GCVE ecosystem.
patch2vuln turns a Git-format patch into a structured draft vulnerability advisory with the assistance of a locally hosted Ollama model. It can assist analysts with information such as the vulnerability title and description as well as classifications including CVSS, CWE, and CAPEC, while keeping the analyst in the review loop.
This use case illustrates how AI can support repetitive parts of vulnerability analysis without replacing the human validation required before publishing a vulnerability record.
Withdrawn KEV information
The workshop discussed how vulnerability information can evolve after publication and why retaining provenance and historical information is important.
One example was:
The case was used to illustrate changes affecting Known Exploited Vulnerability information and the importance of keeping enough source information to understand how and why vulnerability metadata changed over time.
Withdrawn vulnerability records
Similar issues apply to vulnerability records themselves. Vulnerability-Lookup collects records from multiple ecosystems and retains information that can help analysts understand changes in upstream sources.
Examples from the BellSoft OSV source include:
This demonstrates why a vulnerability database should not only expose the latest state of a record, but should also make its source and evolution understandable to users.
Sightings and vulnerability activity
Finally, we demonstrated the use of sightings and additional contextual information to move beyond a purely static description of a vulnerability.
A well-known example is Apache Log4Shell:
The Vulnerability-Lookup view aggregates information such as sightings, detection rules, EPSS, VEX information, and KEV entries, providing additional context about vulnerability activity and relevance.
Moving forward
The workshop confirmed one of the core ideas behind GCVE: vulnerability management is not only about assigning identifiers. It is about enabling an ecosystem in which different producers can allocate, publish, enrich, relate, exchange, and improve vulnerability information while remaining autonomous.
GCVE follows a federated approach and aims to provide building blocks that can be reused in existing CVD processes rather than imposing a single implementation. Open formats, BCPs, open-source tooling, and interoperability with existing vulnerability ecosystems remain central to this approach.
The final session of the workshop was dedicated to the future of GCVE and to discussions around new use cases, producers, tooling, formats, automation, and improvements to the vulnerability disclosure ecosystem.
GCVE is an open initiative, and feedback, experimentation, new GNA use cases, implementations, and contributions are very welcome.