NIST cutback leaves thousands of CVEs without CVSS, shaking risk scoring
NIST’s new enrichment policy leaves 5,000+ CVEs without CVSS scores, forcing teams to rely on inconsistent vendor data. In the first two months only 20% of published CVEs received NIST CVSS vectors, and more than a thousand selected for enrichment remain unanalyzed. This coverage gap threatens automated triage and risk scoring across the industry.