Home / Knowledge hub / NVD
Knowledge hub
NVD
The US government database that adds scores and details to published CVEs.
What it means
The NVD is the National Vulnerability Database, run by the US National Institute of Standards and Technology (NIST). It takes each published CVE record and adds structure: a CVSS severity score, the weakness type, and a list of affected products in a machine-readable form.
The CVE list only says that a flaw exists and gives it a number and a short description. The NVD is the layer on top that lets software search it, filter it and match it against what you actually run, which is what makes automated checking possible.
Why it matters
Scanners, dependency checkers and ticket systems read NVD data to decide whether you are affected and how urgent it is. If the data is wrong or missing, your tooling may miss a flaw you are exposed to, or flood your team with irrelevant ones and wear down trust in the alerts.
The NVD has at times had a backlog of CVEs waiting for analysis, which means a new entry may show no score or product match for a while. Do not treat an empty field as proof of low risk. Use other sources such as vendor advisories alongside it, and check back when an entry changes, because scores are sometimes revised after first publication.
How it shows up
You meet it as a website, as feeds and through an API, and indirectly inside almost every software composition analysis and scanning tool. It uses CPE names to say which versions are affected, and CWE identifiers for the type of weakness. The score is usually CVSS, and sometimes also carries the vendor's own score.
Read entries as a starting point. Check the vendor advisory for the real affected versions, since matching is sometimes too broad or too narrow. Use the API in your own tools rather than copying data by hand, and keep your own record of why a given flaw does or does not apply to you.
Questions people ask
NVD, answered
Is the NVD the same as the CVE list?
No. The CVE Program assigns identifiers and short descriptions. The NVD enriches those records with scores, product names and weakness types.
They work together, but different organisations run them.
Who runs the NVD?
NIST, part of the US Department of Commerce. It is government-run, free to use, and updated as new CVEs are published.
It receives CVE records and adds its own analysis.
Does the NVD list every vulnerability?
Only those with a CVE number. Flaws in your own code, or ones nobody has registered, are not in it.
Most custom application bugs, such as a broken ownership check in your own code, will never get a CVE.
Why does an entry have no score?
It may be waiting for analysis. The NVD has sometimes had a queue of unanalysed records.
Check the vendor advisory or the scoring supplied by the CVE's own authority.
Can we use the NVD data in our product?
NIST provides it for public use through feeds and an API, with rate limits for anonymous use and higher limits with a free key.
Read the current terms on the NVD site before building on it.
Sources
Where this comes from
Related
Terms that sit next to this one
CVE
A public reference number for one known flaw in one piece of software.
CVSS
A scoring system that turns a vulnerability into a number out of ten.
CWE
A catalogue of vulnerability types, rather than individual bugs.
CPE
A standard name for a product and version, used to match software to CVEs.
Dependency vulnerability
A known flaw in a library your application ships.
Not in the NVD, still vulnerable?
Database entries cover known software, not your own logic. We test your application for flaws that will never get a CVE and report only what we exploited. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.