The US Government's Software Flaw Database Is Drowning. Can AI Be the Lifeguard?

Key points

• The National Institute of Standards and Technology (NIST) published a formal request for public input on August 12, 2026, on how to modernise the National Vulnerability Database.
• As of August 2026, researchers have logged 50,340 software vulnerabilities this year, up more than 72% compared to the same period in 2025.
• Fewer than 1% of vulnerabilities reported from GitHub and VulnCheck are actively exploitable, according to a May 2026 analysis by Cisco principal engineer Jerry Gamblin.
• NIST is asking whether AI can handle triage and even automated fixes, but security professionals warn that speed without human checks produces untrustworthy data.
• Public comments on the request close at the end of the day Eastern Time on October 13, 2026.

Somewhere in a government database lives a record of almost every known software flaw on the planet. It is called the National Vulnerability Database, or NVD, and it is run by the National Institute of Standards and Technology (NIST), a US federal agency. When a researcher finds a weakness in software you use, it eventually ends up catalogued here, scored for severity, and used by companies worldwide to decide what to fix first.

Right now, that catalogue is struggling to keep up.

Why is the database falling behind?

The volume of newly reported flaws has exploded. Eight months into 2026, researchers have logged 50,340 software vulnerabilities, a word meaning documented weaknesses that attackers could use to break into a system. That figure is 72% higher than the equivalent point in 2025, driven partly by AI tools that help researchers scan code and spot problems faster than any human team could.

NIST has also faced budget cuts over the past 18 months. In April, the agency said it would focus its limited resources on the most urgent cases: flaws that the Cybersecurity and Infrastructure Security Agency (CISA) has confirmed are being actively exploited, weaknesses in software used by the US federal government, and critical software defined under Executive Order 14028.

For everything else, enrichment, the careful work of adding context, severity scores, and remediation guidance to each record, has slowed.

Should ordinary people be worried?

Not immediately, and here is why. The sheer number is alarming on paper, but Cisco principal engineer Jerry Gamblin, who built the CVE.ICU tracking site, found in a May 2026 analysis that fewer than 1% of vulnerabilities from the two largest reporting sources are actually exploitable in practice. Volume, as Gamblin put it plainly, is not burden.

The real problem is sorting the dangerous 1% from the noise, quickly, and telling defenders clearly what to do about it.

Karthik Swarnam, chief security officer at ArmorCode, told Dark Reading that the NVD today describes what a flaw is, but rarely tells defenders whether anyone is actually using it to attack people right now, or how confident they should be in a given fix. That gap is where modernisation matters most.

What role would AI play?

NIST's August 12 request for public comment asks specifically whether AI can speed up the triage process and whether it could one day recommend or even apply fixes automatically. The agency acknowledged that criminals may use the same AI tools to find and exploit weaknesses at scale.

Security professionals are cautious about leaning on AI too hard. Trey Ford, chief strategy officer at Bugcrowd, told Dark Reading that the NVD's value comes from being neutral and government-run, with no commercial pressure to inflate or downplay a severity score. A patchwork of private-sector scores, each shaped by different incentives, would leave defenders worse off.

Ford's specific concern: if NIST uses AI to clear the backlog but removes human review, the database gets faster and less trustworthy at the same time. That defeats the point.

Public comments are open until October 13, 2026. Security professionals, software makers, and anyone else with a view on how the database should work can submit input directly to NIST.

Common questions

Does this affect the software I use every day?

Indirectly, yes. Businesses and government agencies rely on the NVD to decide which software patches to apply urgently. A slower or less accurate database means some dangerous flaws may not get the urgent attention they deserve.

What should I do right now?

Keep your devices and apps updated. When your phone, computer, or any app prompts you to install an update, do it promptly. Patching known flaws is still the single most effective thing ordinary users can do, regardless of how the database behind the scenes is managed.