“Another outstanding vulnerability researcher named Jerry Gamblin published research showing that since the date of February 15th, 90% of all published CVE’s are still awaiting processing and analysis.”
Since February 15, NIST has left 90% of new CVEs unanalyzed, with no product tags and no severity scores. FedRAMP and the Risk Management Framework are built on that data, and so are countless security tools. NIST’s explanation was a vague notice about a coming consortium that researchers had to notice on their own. The government made its database a compliance requirement and then quietly stopped filling it.