Glossary
Awaiting Analysis (NVD)
The NVD status of a CVE that is published but not yet enriched by NIST: no CPE, often no NVD score.
Awaiting Analysis is an NVD status: the CVE has been received and published in the database, but NIST analysts have not enriched it yet. The other statuses are Received, Undergoing Analysis, Analyzed, Modified, Deferred and Rejected.
In practice, a CVE awaiting analysis has no NVD CPE configuration, often no NVD CVSS score (only the CNA's, if it supplied one) and sometimes no CWE. A product search based on CPE will therefore miss it, even though it can still be found by its identifier.
It says nothing about severity: critical CVEs, sometimes already in the CISA KEV catalog, can stay in this state for weeks. cveo.tech runs a CPE search and a keyword search on the description side by side so they are not missed.
On cveo.tech
Related terms
- NVDNIST's vulnerability database, which enriches each CVE with a CVSS score, a CWE and the affected products.
- CPEA standard naming scheme for software, operating systems and hardware, used to state which products a CVE affects.
- CVEA unique public identifier assigned to a security vulnerability, in the form CVE-YEAR-NUMBER.