The National Vulnerability Database will prioritize only critical software vulnerabilities and those under active exploitation, a strategic shift to address a significant backlog created by a 2024 funding lapse.
NIST's decision marks a substantial change in how the agency manages its vulnerability analysis workload. The database will now concentrate on CVEs listed in CISA's known exploited catalog and vulnerabilities affecting federal government systems.
The funding lapse in 2024 created a substantial backlog that exceeded the agency's capacity to analyze all reported vulnerabilities. Rather than process submissions across the board, NIST is implementing a triage approach focused on threats with the highest impact and immediate risk.
Critical software vulnerabilities—those affecting widely-used systems—remain the primary focus. Vulnerabilities already documented as exploited in the wild by CISA take precedence, reflecting the real-world threat landscape.
The shift acknowledges resource constraints while maintaining focus on vulnerabilities posing the greatest risk to organizations and government infrastructure. NIST continues accepting submissions for all vulnerability types, though analysis timelines for lower-priority entries may extend significantly.
A security researcher discovered nine vulnerabilities in ATM encryption and authentication software. The findings highlight systemic weaknesses affecting critical infrastructure beyond banking.
Anthropic has signed out some Claude users and removed saved payment methods after infostealer malware on their computers hijacked active sessions to drain API usage credits. The company is issuing refunds for unauthorized charges.
Former NYC Traffic Commissioner Sam Schwartz warns that autonomous vehicle expansion creates significant cybersecurity risks, including the potential for bad actors to seize control of connected cars and weaponize them.
More than a decade of Steam files, including beta builds and finished games from Valve and third-party developers, have been exposed in a major data leak totaling over 12 terabytes.