NIST gets overwhelmed, stops rating non-priority flaws

The volume of vulnerabilities is just too damn high

The USA’s National Institute of Standards and Technology (NIST) has announced it will stop rating non-critical vulnerabilities due to the sheer number being submitted.

Starting this month, the service will now only assign a severity rating, as well as other details like affected products, for security issues that meet specific criteria related to the risk they pose.

It will still list all submitted vulnerabilities in the National Vulnerability Database (NVD). However, those considered low severity will only have a rating from the CVE Numbering Authority (CNA) that evaluated and submitted it.

A CNA is an organisation authorised to assign CVE IDs and publish CVE Records. Many are application developers (“Suppliers”) themselves, although CNAs also cover open source software projects, researchers, bug bounty providers and more.

NIST says the volume of submissions it now receives – up 263% between 2020 and 2025 and still accelerating – drove the decision. Although it managed to add details to (“enrich”) 42,000 CVEs in 2025, 45% more than any previous year, it can no longer keep up.

Enriching listed vulnerabilities includes assigning severity scores, classifying weaknesses, naming affected products and linking to patches or related research. The aim is to make them usable for risk management, helping cyber professionals prioritise and mitigate vulnerabilities.

NIST will now only enrich vulnerabilities meeting one of the following criteria:

• Are in CISA’s Known Exploited Vulnerabilities (KEV) catalogue
• Affect the U.S. federal government software
• Involve critical software as per Executive Order 14028

Other steps NIST is taking include not providing a separate severity score for CVEs that already have one from the submitting CNA; only re-analysing CVEs that have been modified prior to enrichment if that modification “materially impacts” the enrichment data; and moving the current backlog of unenriched CVEs (dating from early 2024) to a ‘Not Scheduled’ category’. This does not any CVEs already known to be critical.

The Institute says this approach “will allow us to focus on CVEs with the greatest potential for widespread impact,” though acknowledges that it may miss some high-impact flaws. Users can request enrichment of any vulnerabilities classified as low impact by contacting NIST.