The NVD meaning is straightforward: NVD stands for the National Vulnerability Database, the U.S. government repository maintained by NIST that takes published CVE records and enriches them with severity scores, affected-version data, and references so that vulnerabilities become searchable and actionable. It is one of the most-used data sources in all of security tooling, and yet plenty of people who rely on it every day are fuzzy on what it actually contains and where its data comes from.
Let us clear up the NVD meaning and, just as importantly, what the NVD is not.
What the NVD is
The National Vulnerability Database is run by the National Institute of Standards and Technology (NIST), a U.S. federal agency. It does not invent vulnerability identifiers. Instead, it consumes the CVE list, the master catalog of publicly disclosed vulnerabilities, and layers analysis on top of each entry.
For a given vulnerability, the NVD typically adds:
- A CVSS score quantifying severity, often both the base score and the vector.
- CPE data describing which products and versions are affected, in a machine-readable format.
- CWE mappings categorizing the type of weakness.
- References to advisories, patches, and analysis.
That enrichment is what makes the NVD useful to automated tooling. A raw CVE record might describe a flaw in prose; the NVD attaches structured data that a scanner can match against your software inventory.
Where the data comes from
The chain matters for understanding the NVD's meaning and its limits. A vulnerability is first assigned a CVE identifier by a CVE Numbering Authority (CNA), which might be a vendor, an open-source project, or a coordination body. Once the CVE record is published, NIST ingests it into the NVD and its analysts (and increasingly automated processes) add the CVSS scores, CPE strings, and CWE classifications.
So the NVD sits downstream of CVE. It is a consumer and enricher, not the origin. This is why an NVD entry and a CVE record share the same identifier but the NVD version carries more structured detail.
What the NVD is not
A few common misconceptions are worth correcting.
It is not the same as CVE. CVE is the identifier and the list; the NVD is the enriched database built from it. They are run by different organizations under different programs. Every NVD entry corresponds to a CVE, but the NVD adds the analysis layer.
It is not comprehensive of all vulnerabilities. The NVD only contains what has been assigned a CVE and published. Vulnerabilities that were never assigned a CVE, or that are tracked only in a vendor's private advisory, will not appear. Some ecosystems (npm, PyPI, and others) also maintain their own advisory databases that surface issues faster than, or independently of, the NVD.
It is not always instantaneous or complete. The NVD experienced a well-documented enrichment backlog in 2024, where many published CVEs waited a long time for full analysis and CVSS scoring. That episode was a useful reminder that the NVD is a human-and-process-dependent system, not an oracle that knows everything the moment a flaw is disclosed.
Why it matters to you
If you run any kind of vulnerability scanning, you are almost certainly consuming NVD data, directly or through a tool that does. When a scanner tells you a dependency has a critical vulnerability, it is usually matching your software's version against the affected-version (CPE) data the NVD published for that CVE, and reporting the NVD's CVSS score.
That has a practical implication: your scan results are only as current and accurate as the NVD data behind them. When the NVD enrichment slows, affected-version data can lag, which is one reason good tooling supplements the NVD with additional advisory sources rather than relying on it alone. An SCA tool such as Safeguard draws on the NVD plus ecosystem-specific advisory feeds so a gap in one source does not become a blind spot.
Using the NVD directly
You can query the NVD yourself at its public site or through its API. The API is the practical route for anything automated:
- Look up a specific CVE by ID to see its current CVSS score and affected products.
- Search by product using CPE to find known vulnerabilities in software you run.
- Pull recent changes to keep a local mirror current.
If you build against the API, respect its rate limits (an API key raises them) and remember that a CVE's data can change over time as analysis is completed or revised. Treat the NVD as a living record, not a fixed snapshot. Our Academy walks through incorporating NVD data into a vulnerability management workflow.
FAQ
What does NVD stand for?
NVD stands for National Vulnerability Database. It is the U.S. government's repository of vulnerability data, maintained by the National Institute of Standards and Technology (NIST).
Is the NVD the same as CVE?
No. CVE is the list of vulnerability identifiers, assigned by CVE Numbering Authorities. The NVD is a separate database that ingests those published CVEs and enriches them with CVSS severity scores, affected-version data, and weakness classifications. Every NVD entry maps to a CVE, but the NVD adds the analysis.
Who maintains the NVD?
The National Institute of Standards and Technology (NIST), part of the U.S. Department of Commerce, maintains the NVD. It works alongside the CVE program, which handles identifier assignment through a network of CVE Numbering Authorities.
Does the NVD contain every known vulnerability?
No. It only covers vulnerabilities that have been assigned a CVE and published. Issues without a CVE, or tracked only in private or ecosystem-specific advisories, may not appear. Comprehensive vulnerability management usually combines the NVD with additional advisory sources.