NIST, Overrun by Massive Numbers of Submitted CVEs, Limits Analysis Work

NIST will stop broadly enriching all submitted CVEs in the National Vulnerability Database and will restrict detailed scoring and metadata to vulnerabilities meeting specific criteria (e.g., listed by CISA as exploited, affecting federal software, or covered by Executive Order 14028) because of an exponential rise in submissions and resource shortfalls; the change is expected to shift much of vulnerability triage and contextual prioritization to the private sector, with experts urging security-by-design and distributed, environment-specific analysis amid rising AI-driven vulnerability reporting and exploit capabilities.