Story
NIST gives up enriching most CVEs
1 report
1 website
1 discussion
Latest report
Overview
The US National Institute of Standards and Technology (NIST) will no longer enrich most Common Vulnerabilities and Exposures (CVEs). This decision impacts the level of detail provided for many vulnerabilities in the database.
Summary from risky.biz.
Reports
One report so far. Additional coverage will appear here when it is linked to this story.
Community reactions
Each reaction summarizes sampled comments from the linked discussion.
Hacker News · risky.biz
Hacker News discussion ↗
Historical count: 5 · 5 saved in sample · Historical sample
Analysis ready
Read this discussion’s reaction
Based on 5 sampled comments from this thread. Analyzed 2026-04-18.
- Praise: The shift away from NIST enriching CVEs could encourage private industry to take over, potentially leading to more accurate and timely vulnerability assessments.
- Praise: The ability for vendors to supply their own CVSS scores may empower them to better reflect the actual severity of vulnerabilities, improving prioritization.
- Concern: The lack of enrichment from NIST may lead to inflated severity scores from organizations that issue CVEs, undermining trust in vulnerability assessments.
- Concern: The NVD has been criticized as a poor source of severity data, which could exacerbate the challenges in vulnerability management for software vendors.