Post

Already seen a lot of confusion going on. It’s important to understand that Mitre does not operate the National Vulnerability Database (NVD). While NVD does ingest CVE’s from Mitre, it does not operate this database…

So the recent news about Mitre’s contract would likely only affect new vulnerabilities. Historical vulnerabilities should not be affected. It’s important to call this distinction out, as there’s already been some confusion.

While not great, hopefully we will be able to find out further details in the next couple of days. Also important, it’s the NVD team that enriches the CVE (e.g. assign a CVSS score).