The NVD is the U.S. government repository of standards based vulnerability management data represented using the Security Content Automation Protocol (SCAP). This data enables automation of vulnerability management, security measurement, and compliance. The NVD includes databases of security checklist references, security related software flaws, product names, and impact metrics.

Originally created in 1999 (called Internet - Categorization of Attacks Toolkit or ICAT), the NVD has undergone multiple iterations and improvements and will continue to do so to deliver its services. The NVD is a product of the NIST Computer Security Division, Information Technology Laboratory.

The NVD performs enrichment on CVEs that have been published to the CVE List. NVD staff are tasked with enrichment of CVEs by aggregating data points from the description, references supplied and any supplemental data that can be found publicly at the time. This enrichment results in association impact metrics (Common Vulnerability Scoring System - CVSS), vulnerability types (Common Weakness Enumeration - CWE), and applicability statements (Common Platform Enumeration - CPE), as well as other pertinent metadata. The NVD does not actively perform vulnerability testing, relying on vendors, third party security researchers and vulnerability coordinators to provide information that is then used to assign these attributes. As additional information becomes available CVSS assessments, CWEs, and applicability statements are subject to change. The NVD endeavors to re-assess CVEs that have been amended as time and resources allow to ensure that the information offered is up to date.

Legal Disclaimer:

Here is where you can read the NVD legal disclaimer.