Post

It is operated by NIST. This is an important distinction since most vulnerability scanners use the NVD as the source of vulnerabilities to do their scanning.

So the recent news about Mitre’s contract would likely only affect new vulnerabilities. Historical vulnerabilities should not be affected. It’s important to call this distinction out, as there’s already been some confusion.

While not great, hopefully we will be able to find out further details in the next couple of days. Also important, it’s the NVD team that enriches the CVE (e.g. assign a CVSS score).