CVE vs NVD: What Is the Difference?

The CVE Program provides a common identifier, such as a CVE ID with a year and a number, for each publicly disclosed vulnerability, along with a description and references. Identifiers are assigned by CVE Numbering Authorities, including software vendors, researchers, and coordinators. The programme is operated by MITRE with sponsorship from the US Cybersecurity and Infrastructure Security Agency.

The National Vulnerability Database, maintained by the US National Institute of Standards and Technology, ingests CVE records and enriches them. Enrichment includes CVSS scores, CWE weakness classifications, and CPE configurations that describe which products and versions are affected. Many scanners and tools rely on NVD data to match vulnerabilities to software.

A vulnerability first gets a CVE record. The NVD then analyses that record and publishes its enrichment. The CVE ID is the same in both places. Other databases, such as vendor advisories and open-source vulnerability databases, also reference CVE IDs and may add their own analysis.

NVD enrichment has at times fallen significantly behind CVE publication, most visibly during a backlog that began in early 2024. When enrichment lags, scanners that depend on NVD CPE data may miss vulnerabilities or show them without scores. Teams relying only on NVD can therefore be slow to detect new risks.

Vendor security advisories often contain the most accurate affected-version information. CISA's Known Exploited Vulnerabilities catalogue identifies vulnerabilities exploited in the wild. Ecosystem databases cover open-source packages. Combining sources gives faster and more accurate coverage than any single database.

CVSS base scores describe technical severity, not your risk. The NVD's score may differ from the vendor's score. Exploitation evidence and your own exposure matter more than small score differences when prioritising fixes.

When a new vulnerability is announced, check the CVE record and vendor advisory immediately rather than waiting for NVD enrichment. Use software bills of materials to match components directly by package and version where possible.

In April 2025, the contract funding MITRE's operation of the CVE Program came close to lapsing before an extension was announced, prompting wider discussion of the programme's resilience and of alternative or complementary vulnerability databases. The episode underlined why teams should not depend on a single source.

Use CVE IDs as the common key across scanners, tickets, and advisories. Pull enrichment from NVD where available, and supplement with vendor data, open-source vulnerability databases, and exploitation feeds so triage is not blocked waiting for one source.

Use CVE IDs to name, NVD to enrich, and vendor and exploitation sources to act quickly.

Some ecosystems issue their own identifiers, such as advisory IDs from package registries and vendors, which are often mapped to CVE IDs. Keep these aliases linked in your tracking so one vulnerability is not triaged twice under different names.