What’s the deal with the massive backlog of vulnerabilities at the NVD?
Summary: As of April 9, 5,799 CVEs published since Feb. 15, 2024, remain unanalyzed in the National Vulnerability Database, and NIST is analyzing only about 2.9 percent of published CVEs it receives. NIST cited increased software volume and a change in interagency support, and its budget was cut by about 12 percent after recent U.S. Congress funding bills, while the xz Utility vulnerability still lacked a CWE assignment as of April 10.
What's compelling: Eight of the 10 most-exploited CVEs last year scored 9.3 or higher, so when the NVD stops scoring, patch managers lose the severity signal they use to decide what to fix first, and vendors and researchers assign their own scores with no guarantee of neutrality.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026