Also known as: National Vulnerability Database
The NVD (National Vulnerability Database) is the US government repository, maintained by NIST, that enriches published CVE records with CVSS severity scores, affected product identifiers, and references.
The CVE Program assigns identifiers; the NVD adds the analysis layer on top — severity scoring, CPE product matching, and reference links. Most vulnerability scanners and intelligence feeds are built on NVD data rather than raw CVE records.
The NVD has experienced significant analysis backlogs, during which many CVEs sat published but unenriched — no CVSS score, no product mapping. Any tooling built on it should handle records with missing analysis gracefully rather than assuming every CVE arrives fully scored.
CVE
CVE (Common Vulnerabilities and Exposures) is a public catalogue that assigns a unique identifier, such as CVE-2026-31337, to each publicly disclosed software vulnerability so that everyone can refer to the same flaw unambiguously.
CVSS
CVSS (Common Vulnerability Scoring System) is an open standard that scores the technical severity of a vulnerability from 0.0 to 10.0, based on factors such as attack complexity, required privileges, and impact on confidentiality, integrity, and availability.
CPE
CPE (Common Platform Enumeration) is a structured naming scheme for identifying software, hardware, and operating systems in a machine-readable way, used to state precisely which products and versions a vulnerability affects.
Vulnerability Management
Vulnerability management is the ongoing process of identifying, prioritising, remediating, and verifying fixes for security weaknesses across an organisation's systems and software.