Blog
NIST changed the NVD in April, and the RFI is the next step
In April, NIST changed how the National Vulnerability Database works. It now enriches only CVEs in CISA’s Known Exploited Vulnerabilities catalog, CVEs that affect federal government software, and CVEs in critical software as defined under Executive Order 14028. Everything else is marked “Lowest Priority” and is not scheduled for enrichment, including the backlog from before March 1. NIST cites volume as the reason, since submissions grew 263% between 2020 and 2025.
October 8, 2026