National Vulnerability Database (NVD)

The National Vulnerability Database (NVD), maintained by the US National Institute of Standards and Technology (NIST), is the world's most widely used vulnerability intelligence repository. It builds on the CVE list maintained by MITRE, enriching each CVE entry with: a CVSS v3.x base score and vector string for severity assessment; Common Weakness Enumeration (CWE) classifications identifying the underlying software flaw type; Common Platform Enumeration (CPE) product identifiers for machine-matching against affected products; and reference links to vendor advisories and proof-of-concept resources. NVD data is freely available via a public API and is the primary data source for most commercial and open-source vulnerability management tools.

The CRA requires manufacturers to monitor for vulnerabilities in their products and components and to address them without undue delay. The NVD is the global reference database that most vulnerability scanning and SCA tools use to identify known vulnerabilities in software components. For EU manufacturers, maintaining a subscription to NVD data feeds — either directly via the NIST API or via tools that consume it — is the practical foundation of any vulnerability monitoring programme. CVSS scores from the NVD also provide the standardised severity ratings that manufacturers should use to prioritise remediation and to communicate vulnerability severity to users in security advisories.

Manufacturers integrate NVD data into their vulnerability management workflow in several ways: (1) SCA tools query the NVD API to match components in a product's SBOM against known CVEs; (2) vulnerability scanners use NVD data to identify unpatched software versions; (3) PSIRT teams use NVD CVSS scores to prioritise remediation effort; (4) security advisories reference NVD CVE identifiers to provide users with standardised identifiers for vulnerabilities being addressed; and (5) CSAF advisories include NVD-sourced CVSS data to convey severity. The NVD's CPE dictionary helps automate the matching of disclosed vulnerabilities to specific product versions in the manufacturer's SBOM.

Manufacturers relying solely on the NVD may miss vulnerabilities that are disclosed in vendor advisories or GitHub Security Advisories (GHSA) before NVD analysis is complete — NVD enrichment can lag CVE publication by days or weeks. The NVD backlog issues experienced in 2024 highlighted this risk. Manufacturers should supplement NVD monitoring with the OSV (Open Source Vulnerabilities) database and direct vendor advisory subscriptions for critical components. Another error is treating NVD CVSS base scores as definitive severity ratings without adjusting them with environmental and temporal metrics that reflect the product's specific deployment context.