Cybersecurity Policy Report, As Cyber Vulnerabilities Multiply, NIST Streamlines Cataloging Work, (Apr 16, 2026)
Faced with a torrent of new cyber vulnerabilities to catalog in its National Vulnerability Database (NVD), the National Institute of Standards and Technology has decided to stop listing details about vulnerabilities that seem less consequential.
The NVD catalogs common vulnerabilities and exposures (CVE) that cybersecurity researchers submit to The Mitre Corp., which manages the CVE program for the Cybersecurity and Infrastructure Security Agency.
“In the past, NIST’s NVD program aimed to analyze all CVEs to add details—such as severity scores and product lists—that help cybersecurity professionals prioritize and mitigate vulnerabilities. Going forward, NIST will add details, or ‘enrich,’ those CVEs that meet certain criteria,” NIST said in a news release.
NIST intends to prioritize CVEs that CISA adds to its Known Exploited Vulnerabilities (KEV) catalog, that might affect government systems, or that are deemed “critical software” under standards already established by NIST.
“CVEs that do not meet those criteria will still be listed in the NVD but will not automatically be enriched,” NIST said.
“This change is driven by a surge in CVE submissions, which increased 263% between 2020 and 2025. We don’t expect this trend to let up anytime soon. Submissions during the first three months of 2026 are nearly one-third higher than the same period last year,” NIST noted.
“We are working faster than ever. We enriched nearly 42,000 CVEs in 2025—45% more than any prior year. But this increased productivity is not enough to keep up with growing submissions,” it said.
“We recognize that these changes will affect our users. However, this risk-based approach is necessary to manage the current surge in CVE submissions while we work to align our efforts with the needs of the NVD community,” it said.
“This shift also allows us to dedicate the resources required to develop the automated systems and workflow enhancements that will ensure the program’s long-term sustainability,” NIST added. “We look forward to announcing those improvements as we make them.”
News: FederalLegislation DataSecurity