The gap is widening, not converging
The average correction (NVD’s score minus the CNA’s) sat near +0.3 in the late 2010s and drifted around +0.5 through 2022-24. In 2025 it jumped. Vendors are diverging from NVD, not converging on it.
Caveat: NVD now publishes its own score for only about a third of CVEs, so recent pairs are the subset NVD chose to re-score, which likely skews toward the cases it most disagreed with.
Who gets overruled
| CNA | Pairs | Overruled | NVD raised | NVD lowered | Avg Δ |
|---|---|---|---|---|---|
| VulDB | 5,236 | 99% | 97% | 1% | +2.40 |
| MITRE legacy (bulk) | 2,356 | 15% | 10% | 5% | +0.09 |
| GitHub | 1,945 | 88% | 55% | 33% | +0.47 |
| Vulncheck | 697 | 84% | 43% | 41% | +0.34 |
| Wordfence | 580 | 79% | 20% | 59% | -0.25 |
| MITRE | 483 | 94% | 70% | 24% | +1.46 |
| IBM | 454 | 91% | 68% | 22% | +0.97 |
| Microsoft | 422 | 88% | 42% | 46% | -0.07 |
| Patchstack | 328 | 92% | 45% | 47% | +0.83 |
| Huawei | 268 | 94% | 45% | 49% | -0.01 |
| Dell/EMC | 192 | 91% | 68% | 22% | +0.78 |
| UUID CNA | 191 | 67% | 42% | 25% | +0.16 |
| GitLab | 185 | 92% | 64% | 28% | +0.58 |
| Fortinet | 173 | 79% | 65% | 14% | +1.00 |
| Hcl | 165 | 96% | 81% | 15% | +2.20 |
VulDB is the extreme: NVD overrules it almost always, and almost always upward. Wordfence is the mirror image, NVD usually lowers it. Microsoft NVD accepts directionally (near-zero average) even when it tweaks the vector.
Why this lands on European desks
ENISA’s EU Vulnerability Database takes the CNA’s score, the same “Secondary” number, and passes it through unchanged. So wherever NVD raised the vendor’s score, the EUVD keeps the lower, un-revised one. That is a large part of what looks like “the EU rates vulnerabilities lower than the US.” It is not a European judgment call. It is the vendor’s original number, before NVD marked it up. See where the EU and NVD ‘disagree’.
Which CVSS components NVD changes
On the CVSS 3.1 cases where the base score moved, NVD overwhelmingly touches the impact metrics, and pushes them up.
| Component | Share of changes | Most common shift |
|---|---|---|
| Confidentiality | 24% | L to H ; N to L |
| Availability | 22% | L to H ; N to H |
| Integrity | 21% | L to H ; L to N |
| Privileges Required | 10% | L to N ; N to L |
| Scope | 9% | U to C ; C to U |
| Attack Complexity | 7% | H to L ; L to H |
| User Interaction | 5% | R to N ; N to R |
| Attack Vector | 2% | L to N ; A to N |