NIST is rolling out a risk-based prioritization model for the NVD to cope with a 263% growth in CVE submissions between 2020 and 2025. Enrichment now focuses on CISA’s Known Exploited Vulnerabilities catalog, federal government software, and critical software designated under Executive Order 14028, while everything else gets parked as “lowest priority” pending resources. Translation: if your CVE isn’t already being actively exploited or running on a federal box, good luck getting metadata anytime soon.
NIST Updates NVD Operations to Address Record CVE Growth
··1 min