NVD Explained: How to Read Vulnerability Reports Using CVSS and EPSS

What Is the NVD?

The National Vulnerability Database (NVD)is NIST's public repository of known software vulnerabilities. When a CVE ID is assigned-by MITRE or a CVE Numbering Authority-the NVD picks it up and adds CVSS scores, affected product ranges, and remediation references.

When your security scanner reports CVE-2024-12345 with a score of 8.1, that number came from NVD. The NVD database is searchable at nvd.nist.gov, and every entry has the same structure: a plain-language description, CVSS v3.1 base score with subscores, and a list of affected software versions in CPE (Common Platform Enumeration) format.

Why does this matter in practice? Because the NVD entry is where you find out which versions are vulnerable, whether a patch exists, and how severe the real-world impact is-not just a number out of ten.

CVSS Base Score and Impact Score

CVSS (Common Vulnerability Scoring System) rates vulnerability severity on a 0-10 scale, maintained by FIRST.org. The base score is built from two groups of metrics.

Exploitability metrics:

• Attack Vector (AV). Network (remote), Adjacent (local network), Local (physical access), or Physical. Network-based vulnerabilities are the most dangerous-anyone on the internet can attempt them.
• Attack Complexity (AC). Low means no special conditions. High means the attacker needs a race condition or specific configuration to land the exploit.
• Privileges Required (PR). None, Low (regular user), or High (admin). None is worst-it means unauthenticated attacks.
• User Interaction (UI). None means fully automated exploitation. Required means a victim must click a link or visit a page.

Impact metrics (the "impact score" portion of an NVD entry):

A SQL injection vulnerability on a user database would score High on all three-full read, full write, and potential DoS. That pushes the base score to 9+ (Critical). A missing Referrer-Policy header scores Low on confidentiality and nothing on integrity or availability-that lands in the 3-4 range (Low-Medium).

You can calculate scores yourself using the FIRST.org CVSS v3.1 Calculator.

Severity bands:

EPSS: Predicting Exploit Likelihood

CVSS measures severity. EPSS measures probability. EPSS (Exploit Prediction Scoring System) is a 0-1 daily score that estimates the probability a CVE will be exploited in the wild within the next 30 days. It is published by FIRST.org and updated every 24 hours based on observed threat intelligence.

Here is why this changes your prioritization: a CVE with CVSS 7.5 and EPSS 0.03 is lower priority than a CVE with CVSS 5.5 and EPSS 0.68. The second one has active exploitation happening right now, despite a lower severity score.

A practical rule:

• EPSS < 0.05 - base priority on CVSS alone
• EPSS 0.05-0.1 - watch and patch within normal timeline
• EPSS > 0.1 - treat as one severity level higher than CVSS suggests
• EPSS > 0.5 - active exploitation likely; treat as Critical regardless of CVSS

Most modern scanners pull EPSS automatically and include it alongside the CVSS score. If yours does not, look up any CVE at first.org/epss or via the EPSS API at api.first.org.

Looking Up a CVE in the NVD Database

When a security report lists a CVE ID, this is the lookup flow:

1. Go to nvd.nist.gov and search the CVE ID (e.g. CVE-2024-12345)
2. Read the description-confirm your software and version are in the affected range
3. Note the CVSS v3.1 base score and the three CIA impact subscores
4. Check the CPE entries-these list exact affected versions as machine-readable identifiers
5. Open the References section and find the vendor advisory or patch link
6. Cross-check EPSS if your scanner did not include it

The NVD database CPE entries are how automated scanners match CVEs to your specific stack. If your scanner reports a CVE but you are running a version outside the affected range, check the CPE list before investing time in a patch that does not apply to you.

Prioritizing Fixes

Use CVSS and EPSS together. This table covers most situations:

Context adjusts everything. A Medium CORS misconfiguration on a static marketing page is genuinely medium. The same misconfiguration on your payments API is effectively Critical-same CVSS, different blast radius. Always factor in what data or capability is exposed, not just the raw score from NVD.

When you run a scan with ismycodesafe.com, each finding includes the mapped NVD CVE ID, CVSS base score, and remediation guidance. Start with the Critical and High findings, look them up in the NVD database to verify your version is affected, then work down the list using the EPSS-adjusted priority above.