What is in the National Vulnerability Database and how to read it?

The National Vulnerability Database (NVD), run by NIST, takes CVE records and adds structured data: severity scores, weakness types (CWE), affected products in machine-readable form and links to advisories. Read it as enrichment of a CVE, not the source of truth. Records can lack scores for a while, and scores are not risk.

What is the relationship between CVE and NVD?

A CVE entry is an identifier and a description, published by the CVE program or a numbering authority such as a vendor. NVD builds on that. Its public API returns each record with the original description plus fields from NVD analysts and from other sources. On 18 October 2026, the API reported 409,817 CVE records in total, of which 1,748 carried a CISA Known Exploited Vulnerabilities flag.

NIST itself relies on NVD data in its own guidance. SP 800-124 Rev. 2 tells readers to patch against flaws such as those listed in the NVD, and SP 800-40 Rev. 4 names NVD among the vulnerability feeds to follow.

What does one record look like?

The record for CVE-2021-44228, the Apache Log4j2 flaw widely known as Log4Shell, was pulled from the NVD API on 18 October 2026. The fields that matter:

• Status. The record is marked Analyzed. Across the API you also see statuses such as Awaiting Analysis, Undergoing Analysis, Deferred, Modified and Rejected. A new CVE can sit unscored for a while, so a missing score is not a low score.
• Description. From the Apache source: JNDI features did not protect against attacker-controlled LDAP and similar endpoints, and an attacker who controls log messages could run code loaded from a server. The text notes that version 2.15.0 disabled this by default and 2.16.0 removed it.
• CVSS. NVD assigned CVSS v3.1 base score 10.0, Critical, with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, and an older v2 score of 9.3. Newer records also carry CVSS v4.0 entries. Scores from other sources are listed separately from NVD's own, labelled Secondary versus Primary.
• Weaknesses. NVD lists CWE-917, and the Apache source lists CWE-20, CWE-400 and CWE-502. Different sources can classify the same flaw differently, so treat CWE as a hint.
• Exploitation. A CISA block shows the date added to the Known Exploited Vulnerabilities catalog (2021-12-10), a due date for federal agencies (2021-12-24) and a required action. An SSVC block from CISA records exploitation as active, automatable as yes and technical impact as total.
• Configurations. A tree of CPE match strings says which products and version ranges are affected. The Log4j record has 20 configuration entries, including firmware for unrelated hardware, because products embed the library.
• References. 103 links, many of them vendor advisories. This is where you find fixed versions.

What can mislead you?

Four things come up repeatedly:

1. Score is not risk. A 10.0 on a library you never load is lower priority than a 7.5 on an internet-facing service you run. Combine the score with exposure and exploitation.
2. CPE matching is imperfect. Naming differences cause false positives and false negatives, especially for libraries embedded in other products.
3. Time lag. Enrichment follows publication. Vendor advisories and the CVE record itself can arrive first.
4. Last modified keeps moving. The Log4j record was last modified on 11 August 2026, nearly five years after publication, so a cached copy can be stale.

How to check or apply this

1. Use the API rather than scraping the website. Request a single record with the cveId parameter and read the JSON fields above.
2. Check the status before trusting the score. If it is not Analyzed, look at the CNA's data and the vendor advisory.
3. Compare the primary and secondary scores. If they differ, read both vectors and decide which matches your context.
4. Cross-check the Known Exploited Vulnerabilities flag and the SSVC block for exploitation and automation.
5. Match against your own inventory by package name and version, not only by CPE.
6. Set a polling job for records that affect your inventory, and alert on changes to status or score.

Safeguard scans dependencies against vulnerability data and uses reachability analysis to show whether your code actually calls the affected function, which is the missing piece a raw database record cannot give you. Gold's free in-browser scan at gold.safeguard.sh/scan checks up to 100 dependencies.

Quick check

Sources

• NVD CVE API, record for CVE-2021-44228, queried 18 October 2026
• NVD CVE API, total record count and KEV filter, queried 18 October 2026
• NIST SP 800-124 Rev. 2 and NIST SP 800-40 Rev. 4, for references to NVD as a vulnerability source

Last reviewed: 18 October 2026.