Lion Cipher Lab
Read a CVE JSON 5 record layer by layer and measure what CISA and NVD enrichment add
- Threat Intel Analyst
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Most vulnerability tooling shows you one severity number and one product list and never says who wrote them. In the CVE JSON 5 format they come from different organisations at different times: the vendor or researcher who assigned the CVE (the CNA), the CVE Program, CISA's enrichment team, and, in a separate database, NIST's NVD analysts. They disagree more than people expect, and since 2024 NVD has not been able to enrich everything; in April 2026 NIST said publicly that it would only enrich CVEs that meet priority criteria. If your scanner, your SIEM or your patch dashboard silently relies…
What you'll learn
- Pulling a CVE record from the CVE Services API and the NVD CVE API 2.0, and saving the raw JSON as evidence
- Reading cveMetadata (state, assigner, reserved/published/rejected dates) and the shape of a REJECTED record
- Reading the CNA container's affected[] versions: ranges vs exact versions, versionType, lessThan, changes[] and defaultStatus
- Telling the CNA's data apart from ADP containers (CVE Program references, CISA-ADP SSVC/KEV/CWE/CVSS) and from NVD's own enrichment
- Measuring disagreement between CNA and NVD scores and CWEs, and NVD's analysis lag from its change-history API
- Explaining NVD's 2026 prioritisation change with a measurement of what NVD did and did not enrich
Steps in this lab
- A CVE record is a stack of layers with different authors
- Set up a short working folder
- Download six records three ways and keep the raw JSON
- Read cveMetadata first, and know what a REJECTED record looks like
- Learn the affected[] version grammar before you trust any match
- Print who wrote what: the layers report
- Layer 1, the CNA: the vendor knows the product, not always the format
- Layer 2, the ADPs: what CISA adds, and what it promises never to touch
- Layer 3, NVD: a second opinion that disagrees, arrives later, or never arrives
- Measure the gap at scale: three days of CVEs
- When to trust which layer, and how a pro builds the pipeline