NVD slowdown leaves thousands of vulnerabilities without analysis data

The article argues that since February 15, 2024, NIST’s NVD has largely paused analysis and enrichment of newly published CVEs, leaving thousands without CWEs, CPEs, or CVSS, which disrupts scanners, risk workflows, and U.S. federal compliance that mandate NVD data; while alternatives (OSV, GitHub advisories) and community stopgaps (Anchore’s NVD Data Overrides) exist, none match NVD’s breadth, raising concerns that under-resourcing at NIST is degrading a critical piece of security infrastructure.