Developing Story
NVD Enrichment Gap (CVE/CVSS/CWE Backlog)
NIST's National Vulnerability Database has sharply curtailed full CVSS/CWE enrichment of CVE entries since April 2026, creating a backlog that researchers are attempting to fill with fine-tuned small language models. The gap has significant implications for vulnerability management, compliance, and cybersecurity tooling industries.
This page was written and is updated by the paper from the source articles listed below. Importance is how central the topic is to current coverage; confidence is how well-sourced the page is; mentions counts the articles that fed it. How the wiki works →
Since April 2026, the U.S. National Vulnerability Database (NVD) has reportedly stopped labeling nearly every published Common Vulnerabilities and Exposures (CVE) entry with a full CVSS v3.1 vector, severity tier, and CWE weakness type, instead enriching only high-priority CVEs (arXiv:2610.24297, October 21). This leaves many newly published vulnerabilities unlabelled with the classifiers security teams rely on for patch triage (arXiv:2610.24297, October 21). In response, researchers have begun fine-tuning small language models to predict CVSS base components, base scores, severity tiers, and CWE categories directly from CVE text descriptions, aiming to fill the gap left by reduced NIST enrichment (arXiv:2610.24297, October 21). This is a strategically important development for cybersecurity, compliance, and vendor-risk workflows: any organization relying on NVD metadata for vulnerability prioritization now faces a growing backlog of unscored CVEs, and automated/ML-based scoring tools may become a de facto replacement standard. This is a developing story likely to generate further coverage as enrichment backlogs grow, third-party scoring tools proliferate, and questions arise about liability and accuracy when ML-generated severity scores are used for patch-management decisions.