The National Institute of Standards and Technology is discontinuing enrichment of most Common Vulnerabilities and Exposures (CVEs), citing resource constraints. The move affects the majority of CVE records in its database.
NIST announced it will no longer provide detailed enrichment data for the bulk of CVE entries, focusing resources on a smaller subset of high-impact vulnerabilities. Enrichment—the process of adding context, severity ratings, and additional metadata to CVE records—has been a cornerstone of NIST's National Vulnerability Database.
The decision reflects growing pressure on the organization as the number of disclosed vulnerabilities continues to accelerate. NIST will prioritize enrichment for CVEs affecting critical infrastructure and widely-used software, while leaving most other entries with minimal annotation.
The change may impact security researchers and organizations relying on comprehensive CVE data for vulnerability assessment and prioritization. Alternative sources and community-driven efforts may need to fill the gap left by reduced NIST enrichment coverage.
NIST's move underscores broader challenges in vulnerability management as the security industry grapples with scaling disclosure and analysis across an expanding attack surface.
Anthropic has signed out some Claude users and removed saved payment methods after infostealer malware on their computers hijacked active sessions to drain API usage credits. The company is issuing refunds for unauthorized charges.
Former NYC Traffic Commissioner Sam Schwartz warns that autonomous vehicle expansion creates significant cybersecurity risks, including the potential for bad actors to seize control of connected cars and weaponize them.
Security research firms METR and Redwood have published a detailed postmortem examining the HuggingFace security incident. The analysis provides technical insights into how the breach occurred and what systems were compromised.
More than a decade of Steam files, including beta builds and finished games from Valve and third-party developers, have been exposed in a major data leak totaling over 12 terabytes.