CVE Enrichment & Vulnerability Prioritization
Independent CVE enrichment and vulnerability prioritization for the global security community. Every CVE scored, classified, and mapped to 500+ compliance frameworks — with full provenance on every field.
When NVD stopped enriching CVEs in April 2026, thousands of vulnerabilities lost their CVSS scores, CWE classifications, and product matching. Advisedly fills that gap with multi-source consensus scoring that goes further than NVD ever did.
Look Up a CVE
Returns CVSS score, CWE classification, affected products, EPSS probability, CISA KEV status, and compliance framework mapping with per-field provenance.
Browse Catalog
Recently enriched CVEs. Filter by severity or time period.
| CVE ID | Severity | CVSS | Source | ||
|---|---|---|---|---|---|
| No enriched CVEs found for this filter. | |||||
Enrichment Methodology
Every CVE passes through four independent enrichment stages. Each stage produces a confidence score. When multiple stages agree, confidence rises. When they disagree, the finding is flagged for review.
Vendor Advisory Cross-Enrichment
confidence: 0.9We ingest security advisories from Microsoft MSRC, Red Hat, Ubuntu, Debian, Cisco, Oracle, VMware, Adobe, AWS, Azure, and GCP. When a vendor publishes a CVSS score, CWE classification, or affected product list that NVD lacks, we merge it into the CVE record with full provenance.
Statistical Heuristic Engine
confidence: 0.6-0.8We compute median CVSS scores per CWE across 350,000+ historically scored CVEs. When a new CVE has a CWE classification but no CVSS, the empirical median from that CWE category provides a data-grounded severity estimate — not a guess.
Governed AI Analysis
confidence: 0.5-0.7For CVEs that remain unscored after rule-based methods, a governed AI agent analyzes the vulnerability description to produce CVSS 3.1 base scores, CWE classifications, and affected product extractions. AI scores are guardrailed: they cannot drift more than ±2.0 points from the heuristic baseline.
Multi-Source Consensus
confidence: 0.95 (consensus)When multiple independent signals (vendor advisory, heuristic engine, AI analysis) agree within 1.0 CVSS points, confidence is elevated to 0.95. When they disagree by more than 2.0 points, the finding is flagged for human review. NVD relied on a single analyst; we use three independent methods.
Beyond NVD
Advisedly doesn't just replace NVD's enrichment — it extends it into areas NVD never covered.
Compliance Framework Mapping
Every CVE is automatically mapped to 500+ compliance frameworks (CMMC, FedRAMP, HIPAA, ISO 27001, PCI-DSS, SOC 2, NIST 800-171, and more) via our automated control crosswalk. NVD never provided this.
Per-Field Provenance
Every enriched field (CVSS, CWE, CPE) carries its source, method, confidence score, and timestamp. You always know where a score came from and how much to trust it. NVD provided scores without provenance.
Continuous NVD Revalidation
When NVD eventually scores a CVE we already enriched, we automatically compare. If our score was within 1.0 points, we log the validation. If we were off by more than 2.0, we auto-correct. Our accuracy improves continuously.
Community Corrections
Security researchers can submit corrections via the API. Every correction is reviewed before being applied, creating a feedback loop that no single-vendor database can match.
Sub-3-Hour Enrichment
New CVEs are pulled from NVD every 2 hours. Enrichment runs within 30 minutes of ingest. From NVD publication to fully enriched Advisedly record: under 3 hours.
Data Quality Commitment
Provenance on Every Field
Every CVSS score, CWE classification, and CPE match includes asource,method,confidence, andenriched_at timestamp. Check the enrichment_metadata object in any API response.
Accuracy Targets
CVSS scores within ±1.0 of NVD ground truth for 80%+ of comparable CVEs. CWE classification match rate above 70%. These metrics are computed automatically via our quality baseline and published transparently.
Report an Inaccuracy
Found a wrong score? Submit a correction viaPOST /api/public/cve/:id/correctionwith the field, your suggested value, and rationale. Every correction is reviewed by staff before being applied.
API Reference
The feed is licensed under CC-BY-4.0. Anonymous requests are limited to 100 per minute per IP. Send an API key as Authorization: Bearer cvk_... for registered (600/minute) or partner (3,000/minute) limits. Invalid or expired keys receive 401; a supplied session JWT is not treated as an anonymous request. To request a feed key, email begin@advisedly.ai. List endpoints accept limit (1–200) and offset (0–100,000) and returnhas_more; recent also accepts min_year (1999–2100), period(24h, 7d, 30d, all), and severity (critical, high, medium, low, informational, info). A malformed or stale Authorization header receives 401.
/api/public/cve/:cveIdFull enriched CVE record — CVSS, CWE, CPE, EPSS, KEV, compliance framework mapping, per-field provenance
/api/public/cve/feed/recentRecently enriched CVEs, paginated. Filter by severity (?severity=critical) and period (?period=24h|7d|30d)
/api/public/cve/feed/missing-nvdCVEs that NVD has not scored but Advisedly has independently enriched
/api/public/cve/feed/cvelistv5Paginated CVE Record Format 5.1 ADP records; supports limit, offset, period (24h|7d|30d|all), and severity
/api/public/cve/:cveId/cvelistv5One CVE Record Format 5.1 ADP record
/api/public/cve/feed/statsLive coverage statistics — total CVEs, enrichment breakdown, coverage percentage
/api/public/cve/:cveId/correctionSubmit a correction (field: cvss|cwe|cpe|severity|description; requires reported_value and suggested_value)
/api/public/cve/corrections/statsCorrection submission statistics — total, by status, acceptance rate
Data Sources
CC-BY-4.0 applies only to Advisedly-authored enrichment fields. Upstream records remain subject to their source terms; endoflife.date lifecycle data is CC-BY-SA-4.0. See each source for attribution and terms.
About Advisedly
Advisedly Compliance LLC is a cybersecurity and compliance platform built for DoD, federal, and commercial teams. SAM.gov registered (UEI: XSZ6TYQM2F54, CAGE: 1Z6E9). The Advisedly CVE Database is a public service — free for everyone, alongside paid platform, compliance automation, and managed security offerings.