NIST’s National Vulnerability Database Update and the Vulnerability Enrichment Ecosystem
summary
NVD reports 502 CNAs and a CVE backlog so large that everything before March 1, 2026 moves to a new not scheduled status; KEV-listed CVEs get enrichment within one business day, federal-use and EO14028 “critical software” get next priority, and routine rescoring stops unless requested. CPE assignment consumes half of analysis time, so NVD pursues automation via LLMs and AI agents (planned open source) plus RPA, a public GitHub intake option, and nvidia@nist.gov for escalation.
AI-written summary · about
chapters (12)
- 0:00NVD and CVE history
- 3:18CVE and NVD roles evolution
- 7:10CVE data quality challenges
- 10:58Vulnerability data quality
- 15:10CVE production trends
- 17:15NVD prioritization criteria
- 20:06Severity scoring automation
- 22:56CVE backlog management
- 24:23Automation and AI plans
- 26:51Data quality final thoughts
- 33:47Community engagement call
- 38:19Q&A on CPE and CNA
related talks
30mThe National Vulnerability Database (NVD) – Where It Is and Where It’s Going
30mThe Growing Crisis in CVE Data Quality
30mVulnrichment: Year One
51mPanel Discussion: It is a Tale as Old as Time…. a CNA, the NVD, and a CVE Consumer Walk Into a ...
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
38mThe Enriched CVE Record: Redefining Completeness and Quality for Greater Impact
29mThe Quality Imperative for CVEs: The Need For Enhancing Vulnerability Reporting Standards
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm