NVD vs MITRE CVE: Understanding the Difference

MITRE and NIST NVD are two halves of the same vulnerability pipeline: MITRE runs the CVE Program and assigns the CVE ID (working through 450+ CVE Numbering Authorities), while NIST's National Vulnerability Database ingests every CVE and enriches it with a CVSS severity score, CWE weakness mapping, CPE product identifiers, and searchable metadata. In short, MITRE is the authoritative record that a vulnerability exists; NVD is the analysis layer that tells you how severe it is and what it affects. Every CVE ID originates with MITRE; the score you use to prioritize patching usually comes from NVD.

That's the summary an AI Overview can give you. What it can't tell you is that this pipeline changed materially in 2025–2026 — MITRE's funding nearly lapsed, and NIST has stopped enriching most CVEs. The comparison table, lifecycle diagram, and live CVE lookup below show how the two sources actually diverge today, and how to work around the gaps.

Quick Summary

MITRE CVE List:

• Assigns and maintains CVE IDs
• Provides basic vulnerability information
• Source of truth for CVE assignments
• Minimal enrichment

NIST NVD:

• Builds upon the CVE List
• Adds detailed analysis and scores
• Provides CVSS metrics
• Offers search and API capabilities

Relationship: NVD uses CVE as its foundation and enriches each entry with additional analysis.

The CVE Lifecycle: From CNA to Enriched Record

A single vulnerability flows through three hand-offs. A CNA reserves and describes the flaw, MITRE's CVE List publishes the authoritative ID, and NIST's NVD adds the scoring and product data that scanners consume. The diagram traces one CVE through that pipeline.

Note (2026): Stage 3 is no longer guaranteed. Since April 2026, NIST enriches only higher-priority CVEs, so many records now stop at Stage 2 with no NVD score. See the enrichment section below.

What is MITRE's CVE List?

MITRE (Massachusetts Institute of Technology Research and Engineering) operates the CVE Program, which is the authoritative source for CVE identifiers.

What MITRE Provides

1. CVE ID Assignment

• Assigns unique CVE identifiers (CVE-YYYY-NNNNN)
• Coordinates with 450+ CVE Numbering Authorities (CNAs)
• Manages reserved CVE IDs before public disclosure

2. Basic Vulnerability Information Each CVE entry includes:

• CVE ID: Unique identifier
• Description: Brief explanation of the vulnerability
• References: Links to advisories, patches, research
• Status: Reserved, Published, Rejected, or Disputed
• Date Published: When publicly disclosed

3. CVE List Management

• Maintains authoritative CVE database
• Ensures ID uniqueness
• Handles disputes and corrections
• Manages CVE lifecycle

What MITRE Doesn't Provide

❌ CVSS severity scores ❌ Detailed technical analysis ❌ CWE (weakness type) mappings ❌ CPE (product) identifiers ❌ Advanced search capabilities ❌ Fix/patch information ❌ Exploit assessments

Example MITRE CVE Entry

CVE-2024-1234

Description:
Buffer overflow in Example Software 1.0-2.5 allows remote attackers
to execute arbitrary code via crafted input to the processData function.

References:
- https://vendor.com/security/advisory-2024-001
- https://github.com/example/security-fix

Status: Published
Date Published: 2024-03-15

That's it. Basic but essential information.

What is NIST's National Vulnerability Database?

NIST (National Institute of Standards and Technology) operates the NVD, which is a comprehensive vulnerability database built on top of the CVE List.

What NVD Provides

1. All CVE Information NVD imports every CVE from MITRE, so it includes:

• CVE IDs
• Descriptions
• References
• Publication dates

2. CVSS Scores NVD analysts calculate CVSS (Common Vulnerability Scoring System) scores:

• Base Score: Intrinsic vulnerability characteristics (0.0-10.0)
• Severity Rating: None, Low, Medium, High, Critical
• Vector String: Shows how score was calculated
• CVSS v2 and v3.x scores: Multiple versions for comparison

3. CWE Mappings Categorizes vulnerabilities by weakness type:

• CWE-79: Cross-Site Scripting (XSS)
• CWE-89: SQL Injection
• CWE-78: OS Command Injection
• Helps identify patterns and root causes

4. CPE Identifiers Specifies affected products in machine-readable format:

cpe:2.3:a:vendor:product:1.0:*:*:*:*:*:*:*

Enables automated vulnerability matching in scanners.

5. Configuration Details

• Affected versions
• Vulnerable configurations
• Platform specifics
• Prerequisites for exploitation

6. Enhanced References Additional links beyond MITRE's basic references:

• Patch announcements
• Vendor advisories
• Exploit databases
• Security research

7. Search and Analysis Tools

• Advanced search by CVSS score, CWE, vendor, product
• API access for automation
• Historical data and trends
• Visualizations and statistics

8. Data Feeds

• JSON and XML feeds
• CVE change logs
• Recent additions and modifications
• API for real-time access

Example NVD Entry

The same CVE with NVD enrichment:

CVE-2024-1234

Description: [Same as MITRE]

CVSS v3.1 Score: 9.8 (CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-120 (Buffer Copy without Checking Size of Input)

CPE:
- cpe:2.3:a:example:software:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:example:software:1.5:*:*:*:*:*:*:*
- cpe:2.3:a:example:software:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:example:software:2.5:*:*:*:*:*:*:*

References: [Extended list including exploit databases]

Published: 2024-03-15
Last Modified: 2024-03-16

Much richer information for security analysis.

Key Differences at a Glance

Feature	MITRE CVE	NIST NVD
CVE ID Assignment	✅ Primary source	❌ Uses MITRE IDs
Basic Description	✅ Minimal	✅ Same + enhanced
CVSS Scores	❌ No	✅ Yes (v2, v3.x)
CWE Mapping	❌ No	✅ Yes
CPE Identifiers	❌ No	✅ Yes
Affected Versions	⚠️ Limited	✅ Detailed
Search Capabilities	⚠️ Basic	✅ Advanced
API Access	⚠️ Limited	✅ Comprehensive
Update Frequency	🟢 Real-time	🟡 Hours to days lag
Free Access	✅ Yes	✅ Yes

Which Should You Use?

Use MITRE CVE When:

✅ You need the official CVE ID

• Assigning or reserving CVE IDs
• Verifying CVE exists and is valid
• Checking CVE status (reserved vs. published)

✅ You want the fastest information

• CVE published to MITRE first
• NVD enrichment takes time (hours to days)

✅ You need basic information only

• Just checking if CVE exists
• Looking up references quickly
• Don't need severity scores

Use NIST NVD When:

✅ You need severity assessment

• CVSS scores for prioritization
• Severity ratings (Critical, High, etc.)
• Risk-based vulnerability management

✅ You need detailed technical analysis

• CWE categorization
• Affected product versions
• Configuration details

✅ You're building security tools

• API access for automation
• Machine-readable CPE identifiers
• Data feeds for scanners

✅ You need comprehensive searching

• Search by CVSS score range
• Filter by CWE type
• Find vulnerabilities by vendor/product

✅ You're conducting research

• Historical vulnerability trends
• Exploit analysis
• Weakness pattern identification

How They Work Together

1. CVE Assignment (MITRE)

• Researcher reports vulnerability
• CNA assigns CVE-2024-1234
• Basic information published

2. CVE Ingestion (NVD)

• NVD automatically imports CVE-2024-1234
• Entry appears in NVD with basic info

3. Analysis (NVD)

• NIST analysts review vulnerability
• Calculate CVSS score
• Map to CWE
• Identify CPE for affected products

4. Enrichment (NVD)

• Enhanced entry published
• CVSS score available
• Additional references added
• Searchable by multiple criteria

Timeline: This process typically takes a few hours to a few days after initial CVE publication.

Practical Workflow

For Security Teams:

1. Monitor both sources

   • MITRE for fastest CVE notifications
   • NVD for actionable analysis

2. Use MITRE for awareness

   • Subscribe to CVE feeds
   • Get alerts on new CVEs
   • Track reserved IDs for coordinated disclosure

3. Use NVD for prioritization

   • Check CVSS scores
   • Filter high/critical only
   • Search for your product stack
   • Integrate with scanners

4. Cross-reference both

   • Verify CVE in MITRE
   • Get scoring from NVD
   • Check for updates in both

For Tool Integration:

• Vulnerability Scanners: Use NVD API for CVE details and CPE matching
• SIEM Systems: Ingest NVD data for correlation
• Patch Management: Query NVD for affected versions
• Threat Intelligence: Use both for comprehensive coverage

Important Considerations

NVD Enrichment Is Now Selective (2024–2026)

This is the single biggest change to the CVE ecosystem in years, and it directly changes when you can rely on NVD.

• 2024 backlog: Starting in early 2024, NVD fell badly behind analyzing new CVEs amid staffing and process changes. Thousands of CVEs sat without CVSS scores or CPE data for months.
• The volume problem: CVE submissions rose roughly 263% between 2020 and 2025. NIST enriched nearly 42,000 CVEs in 2025 — 45% more than any prior year — and still could not keep up.
• April 15, 2026 policy shift: NIST stopped trying to clear the backlog. CVEs published before March 1, 2026 that were never analyzed (about 29,000 of a ~33,000 backlog) were reclassified as "Not Scheduled." Going forward, NIST only enriches higher-priority CVEs — those in CISA's Known Exploited Vulnerabilities (KEV) Catalog, software used by the federal government, and "critical software" under Executive Order 14028.
• What this means for you: Many lower-priority CVEs are now listed in NVD without a CVSS score, CWE, or CPE from NIST. You can no longer assume "if it's a real CVE, NVD will score it."

Workarounds:

• Read CVSS vectors published directly by the CNA in the CVE record (increasingly common).
• Pull enrichment from vendor advisories, CISA KEV, and commercial feeds (VulnDB, GitHub Security Advisories, distro trackers).
• Treat NVD as authoritative for the CVEs it still analyzes, and as a starting point — not the finish line — for everything else.

The 2025 MITRE Funding Scare

On April 15, 2025, MITRE warned that its CISA contract to operate the CVE and CWE programs would expire the next day. The community reacted with alarm — a lapse would have frozen new CVE assignments worldwide. CISA executed an 11-month contract extension hours before expiry, funding the program through March 2026, and a group of CVE Board members announced the independent CVE Foundation as a longer-term contingency. The CVE Program continued operating without interruption, but the episode underscored how much of the ecosystem rests on a single government contract.

CVSS Score Disagreements

Sometimes vendor CVSS scores differ from NVD scores:

• Vendors may score based on typical deployments
• NVD scores worst-case scenarios
• Both scores are valid from different perspectives

Best practice: Use the higher score for prioritization to be safe.

CVE Status Changes

CVEs can be:

• Rejected: Determined not to be valid vulnerabilities
• Disputed: Disagreement about validity or impact
• Updated: New information or corrections

Check both MITRE and NVD for status changes.

Other Vulnerability Databases

While MITRE and NVD are the primary sources, other databases provide additional value:

• VulnDB: Commercial database with more detailed analysis
• Exploit Database: Focuses on available exploits
• CVE Details: Community-driven statistics and trends
• GitHub Security Advisories: Open source specific vulnerabilities
• Vendor Databases: Microsoft, Red Hat, Ubuntu security advisories

These often reference CVE IDs but add vendor-specific or specialized information.

Conclusion

MITRE CVE is the authoritative source for CVE identifiers and basic vulnerability information. It's fast, official, and the foundation of the vulnerability ecosystem.

NIST NVD takes CVE data and enriches it with severity scores, technical analysis, and searchable attributes that make it actionable for security teams.

Use both:

• MITRE for awareness and speed
• NVD for analysis and prioritization
• Together they provide comprehensive vulnerability intelligence

Most security tools integrate with NVD because it provides the actionable data needed for automated vulnerability management. However, monitoring MITRE directly ensures you have the fastest possible notification of new vulnerabilities affecting your organization.

---

Look up any CVE below. This tool queries the NVD API for enriched data — CVSS score, CWE mapping, and affected products. If a CVE returns without a score, that's the 2026 enrichment gap in action: the MITRE record exists, but NIST hasn't (and may not) analyze it.

Our CVE Lookup tool is also available as a standalone page for deeper searches.