--- title: NIST Officially Stops Enriching Most CVEs as... description: NIST has formally abandoned its goal of enriching every CVE submitted to the National Vulnerability Database (NVD), shifting to a risk-based model that only... canonical: https://daily.dev/posts/nist-officially-stops-enriching-most-cves-as-vulnerability-v--riarbatp2 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: NIST Officially Stops Enriching Most CVEs as Vulnerability V... | daily.dev og:description: NIST has formally abandoned its goal of enriching every CVE submitted to the National Vulnerability Database (NVD), shifting to a risk-based model that only... og:url: https://daily.dev/posts/nist-officially-stops-enriching-most-cves-as-vulnerability-v--riarbatp2 og:image: https://api.daily.dev/og/posts/riaRbaTp2.png og:image:alt: NIST Officially Stops Enriching Most CVEs as Vulnerability V... og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # NIST Officially Stops Enriching Most CVEs as Vulnerability V... **[Socket](https://daily.dev/sources/socketdev)** · 9 min read · 0 upvotes · 0 comments ## Summary NIST has formally abandoned its goal of enriching every CVE submitted to the National Vulnerability Database (NVD), shifting to a risk-based model that only enriches vulnerabilities in CISA's Known Exploited Vulnerabilities (KEV) catalog, federal government software, or software designated critical under Executive Order 14028. All other CVEs are labeled 'Not Scheduled.' The change is driven by a 263% surge in CVE submissions between 2020 and 2025, with NIST unable to keep pace despite record output of ~42,000 enriched CVEs in 2025. Critics note that thousands of actively exploited vulnerabilities sit outside KEV and will now go unenriched, stripping them of CVSS scores and CPE data that security tools depend on. NIST is also deferring CVSS scoring to CVE Numbering Authorities (CNAs), despite demonstrated disagreements between NVD and GitHub scores on nearly 1,500 CVEs. Security researchers warn the pipeline is already overloaded and unprepared for the additional strain from AI-driven vulnerability discovery tools like Anthropic's Mythos. The consensus among practitioners is that reliance on a single centralized enrichment source is no longer viable. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [NIST Enrichment Reductions Impact CVE Coverage, Accuracy](https://daily.dev/posts/nist-enrichment-reductions-impact-cve-coverage-accuracy-fthy2krrj) · Dark Reading · 0 upvotes · 0 comments - [NVD in the AI Era: Multi-Source Vulnerability Intelligence](https://daily.dev/posts/nvd-in-the-ai-era-multi-source-vulnerability-intelligence-6fw0srlao) · Snyk · 0 upvotes · 0 comments - [NIST Proposes AI-Enabled NVD Overhaul After Cutting Routine CVE Enrichment](https://daily.dev/posts/nist-proposes-ai-enabled-nvd-overhaul-after-cutting-routine-cve-enrichment-w5jgcrqqz) · Socket · 0 upvotes · 0 comments - [NIST Narrows the NVD: What Container Security Programs Should Reassess](https://daily.dev/posts/nist-narrows-the-nvd-what-container-security-programs-should-reassess-frzvnryx5) · Docker · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/nist-officially-stops-enriching-most-cves-as-vulnerability-v--riarbatp2) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"NIST Officially Stops Enriching Most CVEs as Vulnerability V...","url":"https://daily.dev/posts/nist-officially-stops-enriching-most-cves-as-vulnerability-v--riarbatp2","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/nist-officially-stops-enriching-most-cves-as-vulnerability-v--riarbatp2"},"datePublished":"2026-04-17T18:06:52.696Z","dateModified":"2026-04-19T14:29:10.549Z","description":"NIST has formally abandoned its goal of enriching every CVE submitted to the National Vulnerability Database (NVD), shifting to a risk-based model that only...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8cac92aed55d89f61b27981f60295c7f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8cac92aed55d89f61b27981f60295c7f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Socket","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Socket","logo":"https://media.daily.dev/image/upload/s---oEn9czC--/f_auto/v1716187892/logos/socketdev","url":"https://daily.dev/sources/socketdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/nist-officially-stops-enriching-most-cves-as-vulnerability-v--riarbatp2","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Socket","item":"https://daily.dev/sources/socketdev"},{"@type":"ListItem","position":3,"name":"NIST Officially Stops Enriching Most CVEs as Vulnerability V..."}]} ```