NVD Revamps Operations as Vulnerability Reporting Surges

After a tumultuous year marked by internal turmoil and a mounting vulnerability backlog, the National Vulnerability Database (NVD) team within the US National Institute of Standards and Technology (NIST) has finally stabilized.

However, the NVD is now facing a new challenge: a surge in vulnerability reporting that has sent its backlog soaring, threatening to outpace the team's revitalized efforts.

Tanya Brewer, the NVD Program Manager, and Matthew Scholl, Chief of the Computer Security Division at NIST, shared some of NVD’s latest updates on April 10, the final day of VulnCon, an event dedicated to vulnerability management in Raleigh, North Carolina.

They announced several improvements in how the NVD processes vulnerabilities and said they were working on new strategies to catch up with the backlog, including automating more data analysis tasks and exploring AI-powered methods to assist them.

NVD Overcomes Staffing Issues, Boosts CVE Processing

After a year of internal issues due to a contract that supported the work of the NVD ending in early 2024, the team responsible for adding and enriching vulnerabilities (CVEs) to the NVD is now working at full speed, Brewer announced.

In June 2024, NIST extended a commercial contract with an outside consultancy to help resolve the vulnerability backlog.

“[After that,] there was a long period of onboarding a whole new team [after the previous team had to leave due to the previous contract ending], with people going on maternity leave and other challenges, but we are now surpassing the work rate we had before our hiccup,” Brewer said.

A graph displayed to the VulnCon audience supporting Brewer’s speech showed that there were almost no CVEs processed between March and May 2024. In May and June 2024, there was a monthly processing rate well below 2000 CVEs.

However, CVE processing by the NVD team picked up again from August, showing a rate of between 2000 and 3000 CVEs processed monthly – comparable to the pre-March 2024 rate.

In 2025, the NVD team showed an even higher processing rate, with around 3000 CVEs processed per month.