Free tools Windows power users keep installed
One-click scans. No signup required.
The National Vulnerability Database (NVD) is a U.S. government repository maintained by the National Institute of Standards and Technology (NIST). It provides standardized vulnerability-management data that organizations can use to identify software flaws, assess affected products, and support security measurement and compliance. NVD records add analysis and structured details to publicly published CVEs; they are useful input to security decisions, not a substitute for an organization’s own risk assessment.
What is the National Vulnerability Database?
NVD is a repository of standards-based vulnerability-management data maintained by NIST. Its records cover security-related software flaws and misconfigurations, product names, impact metrics, security checklist references, and other information intended to support automated vulnerability management, security measurement, and compliance. NIST established the database in 2005.
As an Amazon Associate I earn from qualifying purchases.
In practical terms, NVD helps make vulnerability information more consistent and machine-readable. Security teams and software tools can use its structured fields to search records, connect vulnerabilities to products, and incorporate data into their own workflows. NIST’s glossary definition describes it as a U.S. government repository that enables vulnerability-management automation, security measurement, and compliance.
Recommended Free Tools
How NVD relates to CVE
CVE is the common identification system for publicly known vulnerabilities. A CVE identifier—often written as a CVE ID—lets people and systems refer to the same vulnerability. The CVE Program and the responsible CVE Numbering Authority (CNA) maintain the CVE record’s description and references. NVD displays that information and may add analysis and structured enrichment. NVD is therefore not the source of every CVE description, and a CVE can be listed even when NVD has not completed enrichment.
#1 Best Overall
NIST’s vulnerability-detail guidance describes fields that may appear in an NVD record:
- CVSS metrics: standardized severity scores and related details.
- CWE mapping: a classification of the kind of weakness involved.
- CPE applicability statements: structured information about products or versions that may be affected.
- References and other analysis: links and context associated with the vulnerability.
- Known Exploited Vulnerabilities (KEV): an indication when the vulnerability is included in CISA’s KEV Catalog.
These fields have different roles: the CVE identifies the vulnerability, while NVD enrichment helps describe its severity, weakness, and potential product applicability.
Rank #2
What CVSS tells you—and what it does not
CVSS communicates vulnerability severity using standardized metrics. NIST explicitly cautions that “CVSS is not a measure of risk.” A score does not establish that a vulnerability is exploitable in your environment, that your assets are affected, or how urgently your organization should act.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Prioritization requires context beyond the score, including whether the affected product and version are present, how the system is exposed, what controls are in place, and the consequences of exploitation for your organization. A KEV listing is a useful additional signal that CISA has identified the vulnerability as known exploited; it still does not replace checking your own systems and response requirements.
Rank #3
How to use NVD records in a vulnerability workflow
- Find the relevant CVE. Search by CVE ID, product, or other available details, then confirm you are looking at the correct vulnerability.
- Check product applicability. Review the CPE applicability information and compare it with your organization’s actual product inventory and versions. Treat a match as a lead to verify, not proof that a particular asset is vulnerable.
- Review severity and weakness details. Read the CVSS metrics and CWE mapping as descriptive inputs. Do not treat a severity score as a complete risk rating.
- Check exploitation context. Look for the KEV section and consult the linked references where needed. A KEV entry signals known exploitation, while your own exposure and impact assessment determine the response in your environment.
- Apply organizational priorities. Combine NVD data with asset criticality, exposure, compensating controls, and remediation capacity to decide what to fix and when.
What changed in NVD operations in 2026
NIST announced on April 15, 2026, that it was moving to a risk-based enrichment model. CVEs remain listed, but records that do not meet NIST’s stated criteria may be classified as lowest priority and not enriched immediately. That distinction matters: the presence of a CVE in NVD does not guarantee that every record will receive the same depth or timing of NIST analysis.
The change came amid rising submission volume. NIST reported that CVE submissions increased 263% from 2020 to 2025. It also said it enriched nearly 42,000 CVEs in 2025—45% more than in any prior year. These are NIST’s reported figures, not a promise of a particular turnaround time for an individual record.
NIST also reported that its NVD API and feeds began carrying SSVC and CVE affected data on June 17, 2026. SSVC data comes from the CISA-Authorized Data Publisher, while affected-product information follows the CVE Record Format. These additions provide further structured data, but the source and meaning of each field remain important when interpreting it.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →NIST separately reported a correction to calculated CVSS v4.0 scores: approximately 4,500 records—19% of records with a v4.0 score—had been scored higher than correct, while fewer than 30 had been scored lower. NIST said it planned to update affected records on April 28, 2026, and document the changes in audit entries. For a record that matters to a decision, check its current detail and audit information rather than relying on an older copied score.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Accessing NVD data
NVD makes vulnerability information available through its website, API, and data feeds. The website and API were reported operational on NIST’s status page on October 7, 2026. Teams automating vulnerability management can consume structured data, but should account for record updates, enrichment status, and the provenance of individual fields instead of assuming every CVE has complete NVD analysis.
For organizations, NVD is most useful when its data is joined to an accurate asset inventory and a defined remediation process. Its standardized records can help locate and compare vulnerability information; they cannot determine on their own whether a listed product is installed, exposed, or sufficiently important to set remediation priority.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
