What Is the National Vulnerability Database (NVD)?

The National Vulnerability Database (NVD) is the U.S. government's public repository of known software vulnerabilities, run by the National Institute of Standards and Technology (NIST). It takes the flaws catalogued in the CVE list and enriches each one with a severity score, affected-product details, and a weakness classification, the data that vulnerability scanners and security teams rely on to find and prioritize risks.

That role is now under severe strain. According to NIST, CVE submissions surged 263% between 2020 and 2025, and in April 2026, NIST scaled the NVD back to fully analyzing only its highest-priority vulnerabilities.

What is the National Vulnerability Database (NVD)?

The NVD is a free, public database that documents known cybersecurity vulnerabilities in software and hardware. NIST launched it in 2005 to give organizations a single, standardized source of vulnerability data they could feed directly into their security tools.

Its defining feature is enrichment. The NVD does not discover vulnerabilities or assign their identifiers. Instead, it takes each published CVE and adds the analysis that makes it usable, turning a raw vulnerability report into something a scanner matches against real systems and a team ranks by severity.

What Data Does the NVD Provide?

For each vulnerability, the NVD layers on several standardized data points:

• CVSS score. The Common Vulnerability Scoring System rates severity from 0 to 10, grouped into low (0.1 to 3.9), medium (4.0 to 6.9), high (7.0 to 8.9), and critical (9.0 to 10.0) bands.
• CPE data. Common Platform Enumeration identifies exactly which products and versions are affected, letting tools match a CVE to specific software.
• CWE classification. Common Weakness Enumeration names the underlying flaw type, such as SQL injection or a buffer overflow.
• References. Links to vendor advisories, patches, and technical write-ups for deeper investigation.

The NVD scores vulnerabilities with CVSS version 3.1, while version 4.0 is being adopted across the industry. In mid-2026, it began adding Stakeholder-Specific Vulnerability Categorization (SSVC) data from CISA to help teams weigh urgency alongside raw severity.

NVD vs CVE: What's the Difference?

The NVD and the CVE list are often confused, but they are separate systems with separate owners. CVE, run by the nonprofit MITRE under the CVE Program, is where vulnerabilities are first recorded and assigned a unique identifier, such as CVE-2026-21962. The NVD then imports that record and enriches it.

How the NVD Process Works

A vulnerability travels a defined path before it reaches the NVD. A CVE Numbering Authority (CNA), often a vendor like Microsoft or a coordinating body, assigns the CVE ID when a flaw is reported, and the CVE Program then publishes the basic record.

From there, NVD analysts enrich it. They assign the CVSS severity score, map the affected products with CPE, classify the weakness with CWE, and attach references. Vulnerability scanners and patch-management tools then pull this enriched data to flag which of an organization's systems are exposed.

The NVD Backlog Crisis and the 2026 Shift to Triage

The NVD's enrichment model broke under its own workload. In February 2024, a contract lapse brought vulnerability processing to a near halt, and a backlog of tens of thousands of unanalyzed CVEs piled up. NIST enriched nearly 42,000 CVEs in 2025, more than in any prior year, yet still fell further behind as submissions kept climbing.

The turmoil reached beyond the NVD. In April 2025, the U.S. government contract funding the CVE Program itself briefly lapsed, raising the prospect that the entire vulnerability-cataloguing pipeline could stall before the funding was renewed at the last minute.

So NIST changed the rules. On April 15, 2026, it moved to risk-based triage, fully enriching only CVEs that appear in CISA's Known Exploited Vulnerabilities catalog, affect federal systems, or qualify as critical software. Everything else, an estimated 80% of new CVEs, is marked “Not Scheduled” and receives no CVSS score, product mapping, or weakness data.

Other sources have stepped in to fill the void. CISA's Vulnrichment program and individual CNAs now supply CVSS and CPE data, the European Union launched its own EUVD, and open-source feeds like OSV expanded their coverage. Organizations that once trusted the NVD as a single source now stitch together several.

Severity is Not the Same as Risk

The NVD's data answers one question well: how severe is a vulnerability? It does not answer a more urgent one: is this flaw being exploited right now? A CVSS score reflects potential impact, not real-world activity, and the two often diverge.

The gap is measured in hours. CloudSEK's honeypot research found that a critical Oracle WebLogic vulnerability (CVE-2026-21962, CVSS 10.0) was attacked the same day its exploit code appeared, long before most tools could react. This is why security teams increasingly pair NVD severity data with exploitation intelligence, such as the CISA KEV catalog and exploit-prediction scoring, to decide what to fix first.

How to Access and Use the NVD

The NVD is free and open at “nvd.nist.gov” and searchable by CVE ID, keyword, product, or severity, making it a quick reference for looking up a specific flaw.

For automation, the NVD offers a public API and downloadable data feeds that tools consume directly. This is how vulnerability scanning platforms and patch managers work: they pull NVD data, match it against an organization's software inventory, and flag what needs attention.

Frequently Asked Questions

Is the NVD only for US organizations?

No, the NVD is a US government resource but is used by security teams worldwide. The European Union launched its own EUVD in 2025 as a regional alternative.

How many CVEs are in the NVD?

The NVD holds more than 300,000 CVEs, with over 308,000 catalogued by the end of 2025. New submissions now exceed 40,000 per year.

What is the difference between the NVD and the CISA KEV catalog?

The NVD catalogues and scores all known CVEs by severity, while the CISA KEV catalogue lists only the CVEs confirmed to be actively exploited. KEV signals urgency; the NVD provides breadth.

Is the National Vulnerability Database shutting down?

No, the NVD is not shutting down; it continues to operate under a new risk-based triage model. It now fully enriches only the highest-priority CVEs rather than every one.

How long does it take for a CVE to appear in the NVD?

A CVE usually appears in the NVD within days of publication, though full enrichment takes longer. Since the 2026 triage change, most CVEs may never receive complete NVD analysis.

Does the NVD list zero-day vulnerabilities?

No, the NVD lists only vulnerabilities that already have a public CVE ID, so true zero-days are absent until they are disclosed. It reflects known, published flaws, not secret ones.