NVD
The U.S. National Vulnerability Database, linked to the CVE numbering system, provides technical details on vulnerabilities such as proof-of-concept code, affected version ranges, and CVSS severity scores. It is an important reference data source for security research.
Core Facts
Timeline (last 90 days)
Teams should follow the GitHub Advisory Database, the NVD, and official project security advisories as authoritative sources of vulnerability information.
NVD is an enriched database built by the US NIST based on CVE identifiers, adding structured fields such as CVSS severity scores, CPE matching, and affected version ranges.
Before connecting Cve.now to a production environment, one should confirm whether its data comes from official CVE/NVD channels, whether it has a stable SLA, and whether it provides a changelog.
There is a time lag between CVE identifier assignment, NVD enrichment (CVSS scoring, CPE matching), and vendor advisories, so directly consuming raw CVE entries may yield data lacking impact-scope descriptions.
There is often a delay of several weeks or even months from when a CVE is assigned an ID to when it enters NVD and is scored, and the two intake paces are not synchronized.
Vulnerability subscription data sources include CVE/NVD, GitHub Security Advisory, OSV and others.
npm's package-lock.json locks the exact hash of every dependency, and npm audit interfaces with the NVD to automatically cross-reference known CVEs.
Every CVE identified by the tool has been cross-validated against the NVD or the GitHub Security Advisory database.
NVD (National Vulnerability Database) is the U.S. national vulnerability database, where more detailed technical information and affected software versions can be queried.
All Facts (9)
NVD (National Vulnerability Database) is the U.S. national vulnerability database, where more detailed technical information and affected software versions can be queried.
65%UnverifiedTeams should follow the GitHub Advisory Database, the NVD, and official project security advisories as authoritative sources of vulnerability information.
50%UnverifiedNVD is an enriched database built by the US NIST based on CVE identifiers, adding structured fields such as CVSS severity scores, CPE matching, and affected version ranges.
50%UnverifiedThere is a time lag between CVE identifier assignment, NVD enrichment (CVSS scoring, CPE matching), and vendor advisories, so directly consuming raw CVE entries may yield data lacking impact-scope descriptions.
50%UnverifiedBefore connecting Cve.now to a production environment, one should confirm whether its data comes from official CVE/NVD channels, whether it has a stable SLA, and whether it provides a changelog.
50%UnverifiedThere is often a delay of several weeks or even months from when a CVE is assigned an ID to when it enters NVD and is scored, and the two intake paces are not synchronized.
50%UnverifiedVulnerability subscription data sources include CVE/NVD, GitHub Security Advisory, OSV and others.
50%Unverifiednpm's package-lock.json locks the exact hash of every dependency, and npm audit interfaces with the NVD to automatically cross-reference known CVEs.
50%UnverifiedEvery CVE identified by the tool has been cross-validated against the NVD or the GitHub Security Advisory database.
50%