NIST

Arvind Raman, formerly dean of engineering at Purdue University, became NIST's 18th director on 30 June 2026, six weeks after the Senate confirmed him on 18 May. He inherited a National Vulnerability Database that had stopped trying to enrich every CVE. NIST counted a 263% rise in CVE submissions between 2020 and 2025, a year in which its analysts still enriched nearly 42,000 records.

Under the 15 April 2026 rules, NVD analysts prioritise flaws in CISA's exploited-vulnerability catalogue, in software federal agencies run and in critical software defined by Executive Order 14028. CVEs published before 1 March 2026 that were still waiting moved to Not Scheduled. NIST also stopped adding its own severity score where the reporting body has supplied one; FIRST, not NIST, owns the CVSS scale. On 10 June CISA replaced its fixed 14-day patch default with 3-day, 14-day, 60-day and next-cycle windows, so NVD priority now follows a triage model that has no published scoring rubric. An Oracle WebLogic flaw scored 7.5 shows the gap: it sat off most emergency lists for 17 months before ransomware crews used it from mid-May 2026.

The White House FY27 request, published on 7 April 2026, asked Congress for $853m for NIST, which the American Institute of Physics counts as a 28% cut to agency programmes. Beyond the NVD, NIST publishes the Cybersecurity Framework, the voluntary standard that many US infrastructure operators and overseas adopters build their security programmes around.