CISA's 'vulnrichment' aims to fix the NVD

CISA announced a vulnerability enrichment program to add CVSS, CPE, CWE, and KEV context to CVEs using an SSVC-based model, stepping in after NIST scaled back NVD enrichment; more than 1,300 CVEs have been processed to support risk-based prioritization. The agency also expanded its Malware Nex-Gen file analysis service to all U.S. organizations amid rising vulnerability exploitation reported by industry, underscoring the need to enhance modern vulnerability and malware defense practices.