snyk.ioarticle

NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence

Snyk analyzes NIST's April 15, 2026 policy change to NVD, which replaced universal CVE enrichment with a risk-based triage model prioritizing CVEs in CISA's KEV catalog, federal-government software, and EO 14028 critical software, while deprioritizing everything else as lowest priority not scheduled. The piece details operational changes (NIST no longer routinely providing an independent CVSS score when a CNA already supplied one, and only reanalyzing modified CVEs when materially impactful) and argues this creates blind spots for scanners that depend solely on NVD, driven by CVE volume growth from about 18000 in 2020 to over 48000 in 2025 due to the federated CNA model and AI-accelerated vulnerability research.