HighEcosystem changeOngoing
NVD stops enriching most CVEs: your scanner’s severity data now has gaps
Since 15 April 2026 NIST no longer adds severity scores or product data to most new CVEs. Tools that match on NVD data miss or misjudge risk.
Vulnerability data advisories
Changes to the vulnerability data developers depend on: CVE, NVD, OSV, GHSA, CISA KEV and EPSS.