Glossary
NVD
National Vulnerability Database
NIST's vulnerability database, which enriches each CVE with a CVSS score, a CWE and the affected products.
The National Vulnerability Database is the US government's vulnerability database, run by NIST. It ingests every CVE record and enriches it: CVSS score, CWE weakness, CPE configurations for the affected products, references tagged by type.
The NVD does not create CVEs, which is the job of the CVE program and its CNAs: it analyses them. Its data is freely available through an API (version 2.0), which cveo.tech queries for its searches and alerts.
Since early 2024 the NVD has built up a large enrichment backlog: many recent CVEs remain in Awaiting Analysis status, with no NVD score and no CPE configuration. The score supplied by the CNA, when there is one, is then the only score available.
On cveo.tech
Related terms
- CVEA unique public identifier assigned to a security vulnerability, in the form CVE-YEAR-NUMBER.
- Awaiting Analysis (NVD)The NVD status of a CVE that is published but not yet enriched by NIST: no CPE, often no NVD score.
- CPEA standard naming scheme for software, operating systems and hardware, used to state which products a CVE affects.
- CVSSA scoring system for the severity of a vulnerability, from 0.0 to 10.0, maintained by FIRST.