The US National Institute of Standards and Technology announced a new policy this Wednesday regarding the US National Vulnerability Database. Under this change, the agency will no longer enrich most CVEs with extended analysis. This shift represents a major change in how critical cybersecurity data is processed and distributed across the tech industry.