The NVD is a US government database of known security weaknesses. It adds its own severity scores and extra details to the public records of each weakness. Many scanners and hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. dashboards read from it, so its scores often end up in the reports you see.
What is the NVD?
NVD stands for National Vulnerability Database. It is run by NIST, the US National Institute of Standards and Technology, and adds its own analysis, severity scores and product data to every published CVE record.
The NVD does not hand out CVEA CVE is a public ID number for one known security weakness in software, such as CVE-2026-109618, so everyone talks about the same problem. IDs. That is the job of the CVE Program and its numbering authorities. The NVD picks up each published record and enriches it. It adds a CVSSCVSS is a score from 0 to 10 that shows how serious a security weakness is, so you can see at a glance which problems to deal with first. severity score, a classification of the type of weakness and a list of affected products and versions in a machine-readable format, so tools can match a flaw against the software you run.
That last part is why the NVD matters in practice. When a scanner tells you that your site “has” a certain vulnerability, it usually compares your detected versions to the product data in a database like this one.
Why the NVD can lag
A new record does not appear fully analyzed. The NVD receives it first and works through a queue afterwards. Between those moments a record carries a status such as Received, which only means that the analysis has not happened yet. A missing NVD score is not a sign that a flaw is minor, and a late score is not a sign that you can wait.
What the NVD means for a PHP or WordPress site
Most of the warnings you see in plugins and scanners trace back to NVD data. For PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. itself, a record for the language runtime lists the affected branches. For WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits., the entries are mostly about plugins and themes, which makes the database useful for checking the exact add-on you run.
The NVD is a reference, not a sentence. It describes a vulnerabilityA vulnerability is a weakness in software that an attacker can use to do something the software was never meant to allow, such as reading private data. in general. It does not know whether the vulnerable feature is switched on for your site, or whether your host already applied a fix to its own packages.
A concrete example
For the two PHP vulnerabilities fixed on 21 October 2026, CVE-2026-109618 and CVE-2026-109619, the PHP Group published the CVE records on cve.org. The NVD received both at 14:17 UTC the same day and completed its analysis at 17:01 UTC (status Analyzed). The NVD gives both its own score of CVSS v3.1 9.8, next to the PHP project’s CVSS v4.0 9.2. The NVD also counts all PHP versions before 8.2.35 as affected, more than the PHP project’s CVE records. You can see how such a difference looks in practice on our PHP2Shell page, where every fact carries its source and the time we checked it.
When to use the NVD, and when to act
Use the NVD when you want the affected product list, the weakness type or a second opinion on severity. Use the maker’s security advisoryA security advisory is an official notice from a software maker about a security weakness: what it is, which versions are affected and how to fix it. when you want to know what to install. If the advisory names fixed versions, that is your trigger, whatever the NVD status says. For real-world exploitation, look at the CISA KEVCISA KEV is a list kept by the US cybersecurity agency CISA of security weaknesses that attackers are known to have used in real attacks. catalog rather than at the NVD.
If you do not know which PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. your site runs, start with the free PHP exposure check. If your version is out of support, the next step is a move to a supported branch through our service to update PHP in WordPress, planned with a backupA backup is a separate copy of your website's files and database, so you can bring the site back after a mistake, a hack or a failed update. and a way back.
Frequently asked questions
Is the NVD the same as CVE?
No. The CVE Program assigns IDs and publishes the basic record. The NVD is a separate database run by the US government that takes those records and adds its own analysis, scores and product data.
Why does a new CVE have no NVD score yet?
The NVD receives records first and analyzes them afterwards, so there is often a gap. A record in the status Received simply has not been analyzed yet. That says nothing about how serious the flaw is.
Do I have to wait for the NVD before I update?
No. The software maker's advisory and the CVE record are enough to decide. If the maker says to update, you do not need an NVD entry to start planning.
Is the NVD score the official severity?
It is one score among possibly several. The party that published the CVE record may have scored it too, and the two can differ. Check who supplied each score.