NVD
National Vulnerability Database
National Vulnerability Database, run by NIST. It enriches CVE records with CVSS scores, CWE mappings and CPE applicability data; since 2024 a large backlog has left many records without that enrichment, so use other sources as well.
- Defined in
- NIST National Vulnerability Database
Covered in
Prioritize vulnerabilities by exploitation, exposure and impact
Rank vulnerabilities with CISA KEV, EPSS, CVSS 4.0 vectors and SSVC decision points, adjust for presence, reachability and asset value, and turn the result into due dates. Covers NVD's 2026 enrichment changes and CISA BOD 26-04.
Triage new dependency vulnerability findings
Turn a weekly batch of Dependabot, OSV-Scanner or npm audit findings into a short list of distinct, shipped, reachable issues, each routed to one outcome: fix, not affected, accept or escalate.
Choose SBOM formats and identify components accurately
Separate schema versions, document references and package identities so inventory conversion and advisory matching preserve meaning.