Who Scores the ScoresStanding
NVD publishes its own severity score for only 34% of recent CVEs
Updated 12 August 2026 · Timeframe: CVEs published 2025-2026 with any CVSS score
Of the 94,775 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 34%. The other 66% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.
Why it matters
Anyone treating 'the NVD score' as an independent second opinion is, most of the time, reading the vendor's own number. NVD's analysis pipeline has not kept pace with CVE volume.
What to do
- Security leaders. Do not assume the NVD score is independent; check whether it is a Primary (NVD) or Secondary (vendor) metric.
- Lean IT orgs. For most recent CVEs, the NVD number is the vendor's number; weigh it accordingly.
- MSPs. Explain to clients that 'NVD-scored' increasingly means 'vendor-scored, mirrored by NVD'.
Our take
Knowing how much of the authoritative database is actually independent analysis is basic data literacy the market skips.
Earlier issues
Past states of this signal, most recent first.
06 August 2026 NVD publishes its own severity score for only 34% of recent CVEs
Timeframe: CVEs published 2025-2026 with any CVSS score
Of the 93,232 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 34%. The other 66% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.
31 July 2026 NVD publishes its own severity score for only 35% of recent CVEs
Timeframe: CVEs published 2025-2026 with any CVSS score
Of the 91,445 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 35%. The other 65% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.
25 July 2026 NVD publishes its own severity score for only 36% of recent CVEs
Timeframe: CVEs published 2025-2026 with any CVSS score
Of the 89,897 CVEs published in 2025-26 that carry any CVSS score, NVD has added its own analyst ('Primary') score to just 36%. The other 64% carry only the score the assigning vendor supplied, which NVD passes through unchanged. The 'authoritative' US database is now mostly a mirror of vendor scores.