NIST Prioritizes NVD Enrichment for CVEs in CISA KEV, Critical Software

NIST is overhauling how it handles the National Vulnerability Database due to a massive surge in CVE submissions, which jumped 263% between 2020 and 2025. Under the new risk-based approach, NIST will prioritize enriching CVEs that are in CISA's Known Exploited Vulnerabilities catalog, affect federal agency software, or impact critical infrastructure, while other vulnerabilities will be marked "Not Scheduled" unless users specifically request enrichment. This strategic shift allows NIST to focus resources on the most critical threats while developing automated systems to better manage the growing backlog of unenriched vulnerability entries.