Security Resilience

Who Scores the ScoresStanding

NVD publishes its own severity score for only 27% of recent CVEs

Updated 13 October 2026 · Timeframe: CVEs published 2025-2026 with any CVSS score

27%73%NVD's own (Primary) score (34,434, 27.3%)Only the vendor's (CNA) score (91,735, 72.7%)
NVD analyst coverage of 2025-26 scored CVEs · security-resilience.ai

Of the 126,169 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 27%. The other 73% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.

Why it matters

Anyone treating 'the NVD score' as an independent second opinion is, most of the time, reading the vendor's own number. NVD's analysis pipeline has not kept pace with CVE volume.

What to do

Our take

Knowing how much of the authoritative database is actually independent analysis is basic data literacy the market skips.

The data behind this

Earlier issues

Past states of this signal, most recent first.

13 October 2026 NVD publishes its own severity score for only 28% of recent CVEs

Timeframe: CVEs published 2025-2026 with any CVSS score

28%72%NVD's own (Primary) score (34,049, 27.9%)Only the vendor's (CNA) score (87,814, 72.1%)

Of the 121,863 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 28%. The other 72% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.

07 October 2026 NVD publishes its own severity score for only 28% of recent CVEs

Timeframe: CVEs published 2025-2026 with any CVSS score

28%72%NVD's own (Primary) score (33,734, 28.3%)Only the vendor's (CNA) score (85,433, 71.7%)

Of the 119,167 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 28%. The other 72% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.

01 October 2026 NVD publishes its own severity score for only 29% of recent CVEs

Timeframe: CVEs published 2025-2026 with any CVSS score

29%71%NVD's own (Primary) score (33,804, 29.0%)Only the vendor's (CNA) score (82,719, 71.0%)

Of the 116,523 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 29%. The other 71% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.

24 September 2026 NVD publishes its own severity score for only 29% of recent CVEs

Timeframe: CVEs published 2025-2026 with any CVSS score

29%71%NVD's own (Primary) score (33,619, 29.3%)Only the vendor's (CNA) score (80,979, 70.7%)

Of the 114,598 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 29%. The other 71% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.

18 September 2026 NVD publishes its own severity score for only 30% of recent CVEs

Timeframe: CVEs published 2025-2026 with any CVSS score

30%70%NVD's own (Primary) score (33,999, 30.5%)Only the vendor's (CNA) score (77,556, 69.5%)

Of the 111,555 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 30%. The other 70% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.

11 September 2026 NVD publishes its own severity score for only 31% of recent CVEs

Timeframe: CVEs published 2025-2026 with any CVSS score

31%69%NVD's own (Primary) score (33,369, 30.8%)Only the vendor's (CNA) score (74,888, 69.2%)

Of the 108,257 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 31%. The other 69% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.

05 September 2026 NVD publishes its own severity score for only 31% of recent CVEs

Timeframe: CVEs published 2025-2026 with any CVSS score

31%69%NVD's own (Primary) score (32,807, 31.2%)Only the vendor's (CNA) score (72,506, 68.8%)

Of the 105,313 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 31%. The other 69% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.

30 August 2026 NVD publishes its own severity score for only 31% of recent CVEs

Timeframe: CVEs published 2025-2026 with any CVSS score

31%69%NVD's own (Primary) score (32,486, 31.4%)Only the vendor's (CNA) score (70,961, 68.6%)

Of the 103,447 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 31%. The other 69% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.

24 August 2026 NVD publishes its own severity score for only 33% of recent CVEs

Timeframe: CVEs published 2025-2026 with any CVSS score

33%67%NVD's own (Primary) score (32,898, 32.6%)Only the vendor's (CNA) score (68,161, 67.4%)

Of the 101,059 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 33%. The other 67% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.

18 August 2026 NVD publishes its own severity score for only 33% of recent CVEs

Timeframe: CVEs published 2025-2026 with any CVSS score

33%67%NVD's own (Primary) score (32,494, 33.2%)Only the vendor's (CNA) score (65,403, 66.8%)

Of the 97,897 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 33%. The other 67% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.

12 August 2026 NVD publishes its own severity score for only 34% of recent CVEs

Timeframe: CVEs published 2025-2026 with any CVSS score

34%66%NVD's own (Primary) score (32,062, 33.8%)Only the vendor's (CNA) score (62,713, 66.2%)

Of the 94,775 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 34%. The other 66% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.

06 August 2026 NVD publishes its own severity score for only 34% of recent CVEs

Timeframe: CVEs published 2025-2026 with any CVSS score

34%66%NVD's own (Primary) score (31,846, 34.2%)Only the vendor's (CNA) score (61,386, 65.8%)

Of the 93,232 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 34%. The other 66% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.