NIST's CVE Enrichment Cutbacks Reduce Vulnerability Database Coverage and Accuracy

Rob Wright

7d ago· 9 min readenNews

Summary

The National Institute of Standards and Technology (NIST) has significantly reduced the number of CVEs receiving enrichment (additional analysis) in its National Vulnerability Database (NVD) since April 2024, due to a severe backlog. New research reveals this cutback is negatively impacting CVE coverage and accuracy, making it harder for security teams to prioritize vulnerabilities effectively. The move has produced mixed results, with fewer CVEs getting the in-depth analysis needed for proper risk assessment.

Source

bskyNIST's CVE Enrichment Cutbacks Reduce Vulnerability Database Coverage and Accuracydarkreading.com

Key quotes

· 3 pulled

In April, the NIST began dramatically reducing the number of CVEs that received 'enrichment,' or additional analysis, from the agency for its National Vulnerability Database (NVD).

The shift was due to a severe backlog in submitted vulnerabilities, which led the NIST to prioritize flaws that, for example, were under exploitation.

New research reveals some concerning trends that could make it harder for security teams to prioritize vulnerabilities.

Snippet from the RSS feed

NIST scaled back on the number of CVEs it selects for in-depth analysis, but the move has produced mixed results.

You might also wanna read

NIST Announces Policy Change: National Vulnerability Database to Stop Enriching Most CVEs

The US National Institute of Standards and Technology (NIST) has announced a significant policy change for the National Vulnerability Databa

risky.biz·2mo ago

NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence

Snyk·13d ago

MongoDB Security Update: Vulnerability CVE-2025-14847 ("Mongobleed") Identified in December 2025

MongoDB has identified a security vulnerability (CVE-2025-14847, informally called "Mongobleed") affecting MongoDB Server. The company outli

mongodb.com·6mo ago

Critical Security Vulnerability CVE-2025-66478 in React Server Components Protocol

A critical security vulnerability (CVE-2025-66478) has been discovered in the React Server Components (RSC) protocol with a CVSS score of 10

nextjs.org·7mo ago

WAF - WAF Release - 2025-05-05

Cloudflare·1y ago

Snyk users don't have to worry about NVD delays

Snyk·2y ago

Comments

No comments yet. Be the first.