NVD (NIST) in VitalSite
How VitalSite uses the NIST National Vulnerability Database to match your detected software versions against known CVEs.
The National Vulnerability Database (NVD), maintained by the U.S. National Institute of Standards and Technology (NIST), is the authoritative public catalog of disclosed software vulnerabilities. Every CVE — Common Vulnerabilities and Exposures — is recorded here with a severity score and description. VitalSite uses the NVD to connect the software on your site to the vulnerabilities that affect it.
What it provides
The NVD is the definitive index of known vulnerabilities, each with a CVE identifier, a CVSS severity rating, and details of which products and versions are affected. It is updated continuously as new vulnerabilities are disclosed, and it is free to query.
Why we use it
Most breaches exploit known, already-patched vulnerabilities in outdated software — not zero-days. The NVD is how we turn "you’re running version X" into "version X has these known high-severity issues, patch it." It grounds our CVE matching check in an authoritative, government-maintained source rather than guesswork.
How VitalSite uses it
After the tech stack fingerprint identifies your server, CMS, and frameworks, VitalSite queries the NVD for known high and critical CVEs affecting those products and surfaces them with their identifiers. You can then confirm whether your exact version is affected and prioritize patching accordingly.
Because the NVD is free and requires no key for basic use, this vulnerability intelligence is available on every scan, including the free tier. The fix for almost any CVE match is the same reassuring step: update to the patched version.
Every VitalSite scan draws on this source automatically. Run a free full-domain scan to see your results, or compare plans and pricing.
See if this affects your site
Run a free full-domain scan — this check runs on every page, with an exact fix guide.