Why does this CVE have no NVD score?
Because NIST no longer enriches every CVE. Since 15 April 2026 the NVD prioritises CVEs in CISA KEV, in software used by the US federal government, or designated critical under Executive Order 14028; everything else is marked lowest priority and not scheduled. A missing score means nobody has assessed it yet — not that the flaw is minor.
The practical mistake is reading a blank NVD record as a quiet CVE. The record is blank because of a queue policy, and the queue policy is about NIST’s capacity, not about your risk. NIST moved every backlogged CVE published before 1 March 2026 into the not-scheduled category in one go, so a large share of older records will simply never be enriched.
What is missing when a record is unenriched is the NVD-assigned CVSS vector, the CPE product mapping and the CWE classification. What is still present is the CNA’s own description, the affected versions the vendor stated, and the references. That is frequently enough to decide whether you are exposed, and it arrives sooner, because the CNA publishes it at disclosure rather than weeks later.
So the workflow that breaks is any queue sorted by NVD severity, because unscored rows sort as zero and disappear off the bottom. The workflow that survives asks a different question first: do we run the affected product, is it reachable, and has anyone been seen attacking it. CISA KEV answers the last part free and is unaffected by the enrichment policy, since KEV entries are precisely the ones NIST still prioritises.
On this site an unscored CVE keeps whatever signal exists rather than rendering as zero: the vendor’s own severity wording where the numeric score is absent, the EPSS probability, and the KEV flag. As of September 2026 we hold more than 16,000 analysed CVEs with EPSS on 99% of them. Treat that as a way to keep triaging while NVD is silent, not as a substitute for the vendor advisory, which stays the only authority on the fixed version.