What is the NVD?
The National Vulnerability Database (NVD) is the U.S. government's public repository of vulnerability data, run by the National Institute of Standards and Technology (NIST). It is built on top of the CVE List. Published CVE records flow into the NVD, where analysts add the details that tools need to act on them: a severity score, the type of weakness behind the flaw and a precise list of affected products. Scanners, patch management tools and asset inventories pull this data to decide which findings apply to which systems.
What the NVD adds to a CVE
- CVSS scores: a base score and vector string calculated by NIST analysts. Where the CVE Numbering Authority also supplied a score, both appear, and they don't always agree.
- CWE mappings: one or more Common Weakness Enumeration IDs naming the category of mistake, such as CWE-89 for SQL injection.
- CPE applicability: Common Platform Enumeration names that identify the affected products and version ranges.
- Tagged references: links to vendor advisories, patches and exploit write-ups, each labeled by type.
Records also show when a CVE appears in CISA's Known Exploited Vulnerabilities catalog. NIST describes the NVD as standards-based vulnerability data represented with SCAP, which is why SCAP-compatible tools can consume it directly.
Reading a CPE name
CPE is what lets a scanner decide that a particular server is affected. A CPE 2.3 name lists the part, vendor, product and version, with wildcards for fields that don't matter:
cpe:2.3:a:apache:log4j:2.14.1:*:*:*:*:*:*:*
Here a means application (the other parts are o for operating system and h for hardware), the vendor is Apache, the product is Log4j and the version is 2.14.1. The NVD record for Log4Shell, CVE-2021-44228, lists ranges of Log4j versions as vulnerable, so any inventory entry that falls inside one of those ranges is flagged.
Backlogs and other sources
Enrichment takes analyst time. Since early 2024 the NVD has gone through long periods when it could not keep up with the number of new CVEs, and many records waited weeks or months with only the CNA's data. In response, more CNAs now put their own CVSS scores, CWE IDs and affected versions into the CVE record, and CISA has added similar data to many records. Experienced teams treat the NVD as one source among several: vendor advisories for the authoritative fix, the CVE record itself, and exploitation signals such as the KEV catalog and EPSS.
NVD vs. CVE vs. CVSS
- CVE: the identifier and basic record for one vulnerability, assigned by a CNA.
- NVD: NIST's database that takes CVE records and adds scores, weakness types and product data.
- CVSS: the scoring standard, maintained by FIRST, that the NVD uses to rate severity.
- KEV: CISA's list of CVEs known to be exploited, a priority signal rather than a database of every flaw.
NVD on the CompTIA Security+ exam
The NVD is a newly added entry on the SY0-801 acronym list and belongs with CVE identifiers and CVSS scores under objective 2.1, which covers how vulnerabilities are identified and rated. A question that asks where to look up a CVE's severity score, affected product versions or weakness category in a government-run public database points to the NVD. Keep the roles apart, because they are each other's distractors: CVE names a flaw, CVSS scores it, CWE categorizes it and the NVD collects and enriches the data. NIST runs the NVD, the CVE Program has long been operated by MITRE, and FIRST maintains CVSS.