A new CVE can appear with no severity score or affected product list because the National Vulnerability Database adds that detail later, and since April 2026 it enriches only some records on a priority basis. A missing score does not mean low risk. It means the data is not there yet.
What enrichment is
A CVE record starts as a short description plus references, supplied by the organisation that assigned the ID. Enrichment is the extra work: a severity score, a weakness type, and a machine readable list of affected products and versions. Scanners lean on that last item to match a CVE to your software, so a record without it is hard to match automatically.
What NVD says about priorities
NVD announced changes on 15 April 2026. In summary:
- CVEs in the CISA KEV catalog are prioritised, with a goal of enrichment within one business day.
- CVEs for federal government software and for critical software under Executive Order 14028 are also prioritised.
- Other CVEs are labelled "Lowest Priority" and are not scheduled for immediate enrichment.
- NVD no longer routinely adds its own score when the CVE Numbering Authority has already provided one.
- Backlogged CVEs with an NVD publish date before 1 March 2026 moved to a "Not Scheduled" category.
NVD also reports that submissions rose 263 percent from 2020 to 2025, which explains why it needed to triage.
What this means for your scanner
Three practical effects follow.
- A scanner that depends only on NVD product data will miss or delay records that were never enriched.
- The score you see may come from the CNA rather than NVD, so two tools can show different numbers for the same CVE.
- Ecosystem databases, such as package registry advisories, often carry their own package and version data, so they can fill the gap.
For package level matching, many teams therefore read at least one ecosystem advisory source in addition to NVD. See CVE, GHSA and OSV IDs: what are the differences.
What to do while a score is missing
| Situation | Action |
|---|---|
| In the KEV catalog | Treat as urgent, regardless of score |
| Affects a package you run, no score | Read the advisory text, judge exposure yourself |
| No package match anywhere | Watch it, and recheck when data arrives |
Do not leave unscored records out of triage. Give them an owner and a recheck date, and treat a missing score as unknown, not as zero.
Where Safeguard fits
Safeguard's dependency scanning and reachability analysis help you judge exposure when scoring lags, because they show whether the vulnerable code path is used. A free scan shows how findings appear with and without scores.
Quick check
Is a CVE without a CVSS score safe to ignore?
No. The score is simply absent. Check exploitation evidence, the advisory text and whether you run the affected component.
Why do two tools show different scores for one CVE?
They may read different sources, such as the CNA score versus an NVD score, or they may have synced at different times.
Sources
Last reviewed: 19 October 2026.
