NIST narrows scope of CVE analysis to keep up with rising tide of vulnerabilities

NIST will narrow prioritization in the National Vulnerability Database—focusing enrichment on CVEs appearing in CISA's known exploited vulnerabilities catalog, federal software, and critical software under Executive Order 14028—after a surge in CVE submissions and a prior funding lapse left a backlog; lower-priority CVEs will remain listed but may not receive automatic enrichment, shifting more authoritative responsibility to CNAs and vendors and changing how defenders source vulnerability intelligence.