Skip to content

NVD CVE API ยท Developer Guide

Cybersecurity Risk Prioritization After The 2026 NVD Change

The National Vulnerability Database (NVD), maintained by the US National Institute of Standards and Technology (NIST), is the reference most security teams rely on to assess newly disclosed software flaws. Its severity scores, delivered through the NVD CVE API, determine how scanners and patch management tools prioritise remediation.

Start with the quickstart Read the AI draft audit

New here? Take the 30-second tour

263%Rise in CVE submissions between 2020 and 2025
15 Apr 2026NIST moves to risk-based scoring
DeferredStatus for records with no NIST review planned

The Problem

What changed NIST previously aimed to analyse and score every vulnerability published in the NVD. With submissions up 263% between 2020 and 2025, that model became unsustainable. Since April 2026, NIST has scored only vulnerabilities under active exploitation and those affecting software the US government depends on.

What breaks Every other CVE still appears in the NVD, but without a severity score from NIST. Many carry a Deferred status in the API, shown as "Not Scheduled" on the NVD website, NIST's signal that no review is planned. Tools that sort flaws by score push these records to the bottom of the list. NVD search also hides deferred records by default, so some never reach the team responsible for fixing them.

Real example CVE-2026-6584, an authorization bypass in the open-source AI agent framework SuperAGI, was published in April 2026 without a NIST score. Its status reads Deferred in the API and "Not Scheduled" on the website. The only scores come from VulDB, including a CVSS 3.1 rating of 5.4. Tools that read only NIST's score rank it among the lowest priorities, although nothing about the vulnerability indicates low severity.

Guides

  • Quickstart

    Retrieve a single CVE through the API and identify the fields that indicate severity and active exploitation.

    Open the quickstart

  • Reading Records After The 2026 Change

    Interpret a record's vulnStatus and establish the source of a severity score when NIST has not assigned one.

    Read the guide

  • AI Draft Audit

    Fifteen errors in one Gemini-generated guide, and the review method that catches them.

    See the audit

  • LLM Evaluation Kit

    ChatGPT and Gemini scored against the live NVD record, with a rubric, preference pairs and red-team prompts.

    See the results

  • In-App Guidance

    A release announcement and onboarding flow for the docs, defined in JSON and deployed with every merge.

    See the design

  • Coming Next

    A guide to spotting actively exploited flaws with CISA KEV data, followed by a full parameter reference and a troubleshooting page.

Background Reading

API responses captured from the live NVD API, October 2026, and rechecked on November 1, 2026. Licensed under CC BY 4.0. Written and maintained by Archana Panda, Senior Technical Writer.