NVD

NVD stands for National Vulnerability Database. It is a U.S. government repository of standardized vulnerability management data, maintained by the National Institute of Standards and Technology (NIST) with contributions from federal agencies. The database provides detailed information about publicly disclosed cybersecurity vulnerabilities and exposures to support organizations in risk assessment, prioritization, and remediation.

Each vulnerability entry in the NVD is linked to a CVE identifier and enriched with metadata such as the CVSS score (both versions 2 and 3 when applicable), impact metrics for confidentiality, integrity, and availability, exploitability, and requirements. NVD also associates vulnerabilities with CWE entries (categories of weaknesses) and CPE names to identify affected platforms and products. References and advisories are included to guide users to patches and mitigations.

The NVD collects data from the CVE program and standardizes it to facilitate automated processing. It provides a range of data feeds in JSON and XML formats that are used by security tooling, vulnerability scanners, and incident response systems. The feeds are updated regularly to reflect new disclosures, revised scores, and updated impact information.

Organizations use NVD to assess risk, research vulnerability details, and prioritize remediation based on severity, affected products, and exploitability. The database contributes to broader efforts in vulnerability management and standardized vulnerability information exchange across the cybersecurity community.