National Vulnerability Database

Name

National Vulnerability Database

Legal name

National Vulnerability Database

Website

https://nist.gov

Company type

Private

Founded year

2005

Operating status

Operating

Ownership category

akta.pro rank

Product category

Vulnerability Management Database

NAICS

Security Systems Services (except Locksmiths) (561621), Security Systems Services (56162)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Vulnerability Assessment & Scanning (HDADAHAA)

akta.pro secondary industry

Exposure Analytics & Risk-Based Prioritization (RBVM) (HDADAHAF)

Keywords

• Vulnerability management
• CVE database
• Cybersecurity standards
• Security metrics
• Compliance data

Headquarters

HQ city

Gaithersburg

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Infrastructure, Operations

Revenue model

1. Public Government Service: The NVD is a free, publicly available government resource maintained by NIST. It operates under the federal government mission to provide standards-based vulnerability management data to the public. There is no commercial revenue model as this is a government service provided for national cybersecurity benefit.

Distribution channels2 records

Marketing channels1 record

Core offering

The National Vulnerability Database (NVD) is the U.S. government repository of standards-based vulnerability management data, maintained by the National Institute of Standards and Technology (NIST). It provides structured vulnerability records, including Common Vulnerabilities and Exposures (CVE) identifiers, Common Vulnerability Scoring System (CVSS) severity scores, Common Weakness Enumeration (CWE) classifications, and Common Platform Enumeration (CPE) product mappings to support automated security management, measurement, and compliance.

Product overview

The National Vulnerability Database (NVD) is a U.S. government-hosted repository of vulnerability management data maintained by NIST. It serves as the official source for vulnerability information in the national and international cybersecurity ecosystem. The NVD provides structured vulnerability records including CVE identifiers, severity scores (CVSS), affected products, and related references. It operates as a single, centralized database offering standardized vulnerability data for automated consumption, rather than as a commercial product with multiple modules or tiers.

Differentiator

Problem solved

Functional benefit

Products and services

• National Vulnerability Database (NVD) A comprehensive publicly available database of vulnerability management data, including CVE identifiers, CVSS severity scores, CWE weakness classifications, CPE product mappings, and security checklist references. Designed for federal agencies, cybersecurity professionals, and critical infrastructure operators to perform automated vulnerability management, security measurement, and compliance.
• NVD API
• NVD Data Feeds Downloadable data feeds providing machine-readable vulnerability data for integration into external security tools, vulnerability scanners, and compliance reporting systems.

Quantifiable outcome

• Authoritative source for vulnerability data used by security tools and government compliance frameworks

Named customers3 records

Segments3 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature1 record

Scale indicators3 records

Recent moves3 records

Expansion highlights3 records

Direct peers

• MITRE Corporation: MITRE operates the CVE program and several related security standards (CWE). As the upstream originator of the CVE identifiers that NVD enriches, MITRE is the closest functional peer and a direct collaborator in the vulnerability management data ecosystem.

Broad incumbents

• Rapid7: Rapid7's InsightVM and Metasploit products ingest NVD feeds and serve vulnerability management use cases for the same enterprise security audience. It competes with NVD's standardization role via its own research and vulnerability prioritization.
• Tenable: Tenable (Nessus) is the leading commercial vulnerability management platform and one of the largest consumers and contributors to NVD's CPE/CVE data. It serves the same security teams with broader commercial vulnerability assessment capabilities.
• Snyk: Snyk focuses on developer-first vulnerability scanning (open source, containers, code) and maintains its own vulnerability database alongside NVD. It targets a related but more developer-centric slice of the same vulnerability intelligence market.
• Qualys: Qualys VMDR is a major enterprise vulnerability management platform that depends on NVD feeds for CVE matching and severity scoring, and addresses the same downstream use case of identifying and prioritizing vulnerabilities.

Emerging players

• VulnCheck: VulnCheck provides commercial, real-time, exploit-aware vulnerability intelligence that competes for the same downstream consumers (security teams, vulnerability management platforms) that integrate NVD data — a more agile, enriched alternative.

Regional players

• JVN (Japan Vulnerability Notes): JVN is the Japanese national vulnerability database operated by JPCERT/CC. It serves a similar authoritative-vulnerability-intelligence role for Japanese software disclosures and parallels NVD's domestic-coordinator function.
• CNNVD (China National Vulnerability Database): CNNVD is China's national vulnerability database, operated under CNCERT. It is the closest regional peer to NVD — performing the same authoritative vulnerability enumeration role for Chinese disclosures and serving Chinese government and critical infrastructure users.

Others

• GitHub Advisory Database: GitHub's Advisory Database curates open source vulnerability information and is increasingly a first-publisher for many CVEs. It overlaps with NVD's role in open source vulnerability tracking and serves a related ecosystem of developers and security teams.
• CISA Known Exploited Vulnerabilities (KEV) Catalog: CISA's KEV catalog is a U.S. government companion to NVD, layering exploitation evidence on top of CVE records. It serves the same federal and critical infrastructure audience with prioritized, exploitation-driven vulnerability intelligence.

Market position

Strengths4 records

Weaknesses4 records

Competitive moat3 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/NIST
• YouTubeyoutube.com/NIST
• Facebookfacebook.com/NIST
• LinkedInlinkedin.com/company/nist
• Instagraminstagram.com/nist

Revenue estimate

Valuation estimate

Number of profiles

Profiles1 record

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about National Vulnerability Database