National Vulnerability Database
NIST's US government database of CVE severity and product data.
NIST's vulnerability database has triaged rather than analysed new flaws since 15 April 2026, when it parked every backlogged CVE published before 1 March as "Not Scheduled". Its queue grew as CVE submissions climbed 263 per cent between 2020 and 2025.
Last refreshed: 12 October 2026
Why has the US vulnerability database stopped analysing most new flaws?
Timeline for National Vulnerability Database
Named as National Vulnerability Database
Cybersecurity: Threats and Defences: Mentioned in: Microsoft fixes 973 flaws in one releaseMentioned in: Old Linux container bug back in the wild
Cybersecurity: Threats and DefencesMentioned in: WebLogic flaw revived as ransomware vector
Cybersecurity: Threats and DefencesMentioned in: 17-year-old Office RCE back on KEV
Cybersecurity: Threats and DefencesBackground
The National Vulnerability Database is the US government store of vulnerability data, run by NIST, the federal standards agency. For each published CVE it records a severity score and the affected products. Its role came under strain again in September 2026, when Microsoft shipped 973 fixes in one monthly release.
NIST dates its backlog to early 2024. CVE submissions rose 263 per cent between 2020 and 2025, and NIST analysts fell further behind even after enriching nearly 42,000 records in 2025. On 15 April 2026 NIST moved every unanalysed CVE published before 1 March 2026 into a "Not Scheduled" status.
NIST now analyses three groups first: flaws on CISA's Known Exploited Vulnerabilities catalogue, software that federal agencies run, and critical software as defined by Executive Order 14028. Where the issuing authority already supplied a score, NIST no longer routinely adds its own. Decades-old flaws keep landing on that CISA catalogue, such as a 17-year-old Office bug confirmed as exploited on 14 April 2026.