NIST's security flaw database still backlogged with 17K+ unprocessed bugs. Not great

NIST’s National Vulnerability Database has missed its Sept. 30 target to return to pre-February enrichment rates, leaving roughly 17–18k CVEs unanalyzed and reducing organizations’ visibility into newly disclosed vulnerabilities. Analysis from VulnCheck and industry experts highlights ongoing operational risk, despite improvements since May and the hiring of a contractor, with CISA’s Vulnrichment project serving as a stopgap for severity scoring and related data. The backlog’s exact risk remains unclear due to limited transparency into which CVEs await processing, and stakeholders warn the slowdown is straining security processes and open-source projects that depend on NVD data.