--- title: Central Vulnerability Database description: The Central Vulnerability Database \(CVDB\) is a source-agnostic vulnerability data repository that consolidates and enriches vulnerability records from multiple security sources into a single, authoritative view. Use CVDB to eliminate conflicting data across your vulnerability integrations and gain full visibility into which source is authoritative for each field. locale: en-US canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/cvd-overview.html release: australia product: Vulnerability Response classification: vulnerability-response topic_type: concept last_updated: "2026-03-28" reading_time_minutes: 4 keywords: [cvdb] breadcrumb: [Vulnerability Response integrations, Vulnerability Response, Unified Security Exposure Management, Security Operations] --- # Central Vulnerability Database The Central Vulnerability Database \(CVDB\) is a source-agnostic vulnerability data repository that consolidates and enriches vulnerability records from multiple security sources into a single, authoritative view. Use CVDB to eliminate conflicting data across your vulnerability integrations and gain full visibility into which source is authoritative for each field. Before CVDB, integrations would directly override fields on vulnerability records or create only placeholder entries. When a higher-quality source reported on the same Common Vulnerabilities and Exposures \(CVEs\), existing data could be silently overwritten. CVDB replaces this with a configurable, priority-based enrichment framework that preserves source fidelity while surfacing the most authoritative data for each field. ## How Central Vulnerability Database works CVDB acts as a centralized hub that integration plugins feed into via the `CVDUtil` API. Each integration source's raw data is preserved in dedicated source-specific tables. The consolidated CVDB record reflects the highest-priority value for each field, and a field update history tracks exactly which source last updated every field, providing full data provenance \(a traceable record of where each field value came from\). CVDB uses a two-tier priority system to resolve conflicts when multiple sources report on the same vulnerability: - **Source-level priority**: Determines default precedence across all fields. For example, NVD takes precedence over scanner sources by default. - **Field-level priority**: Overrides source-level defaults for specific fields. For example, Vulnerability Intelligence fields such as Mandiant or Recorded Future takes precedence for exploit status, while NVD remains authoritative for CVSS scores. ## Supported sources CVDB supports a broad ecosystem of upstream sources spanning authoritative vulnerability databases, enterprise scanners, and threat intelligence feeds: - **Authoritative databases**: NVD, EUVD, JVN, CISA KEV, EPSS - **Vulnerability scanners**: Microsoft Defender Vulnerability Management, Palo Alto Prisma Cloud, Qualys, Wiz - **Application security tools**: Veracode, GitHub, Black Duck Vulnerability Response, Container Security, and SBOM Response leverage enriched CVDB data for remediation workflows. CVDB includes a priority configuration for ingesting CVEs. The Vulnerabilities Entries table \(`sn_vul_nvd_entry_LIST`\) now supports non-CVE vulnerability databases. When CVEs become irrelevant, alternative sources such as EUVD and JVN can be used to populate the `sn_vul_nvd_entry` table. ## Viewing vulnerability sources To view the vulnerability sources: 1. Navigate to **Workspaces** > **Security Exposure Management**. 2. In the left navigation, select **List**. 3. Under **Lists**, navigate to **Libraries** > **Vulnerabilities**. In the Libraries - Vulnerabilities List page, a new **Sources** column is added, which displays all the sources that have enriched a given CVE. Even if NVD produces a CVE without enrichment, other sources such as Microsoft Defender Vulnerability Management, Qualys, and Mandiant can be used to enrich the CVE record. ## Priority-based field configuration Fields are no longer overridden directly. The updated model uses priority-based configuration to define which source provides which field value. This configuration is managed through the Source Configurations \[sn\_sec\_cvd\_source\_config\_list.do\] table. To access Source Configurations, enter `sn_sec_cvd_source_config.LIST` in the Filter Navigator. Multiple sources that provide CVE information are listed here, each assigned a priority. NVD holds the highest priority, followed by other registered sources. ## Source-specific attribute tables A separate table is maintained for each source, containing attributes specific to that source that enrich CVE records. Rather than writing enrichment data directly to the NVD table, source-specific tables are added as references in CVE records. These tables can be found in sys\_db\_object\_list.do. Attributes from different sources can then be selected within the NVD Entries table \[sn\_vul\_nvd\_entry\_list.do\]. ## CVDUtil API CVDUtil is the central API for ingesting vulnerability data into the NVD entries table. It applies priority-based processing to determine which source fields are written to the record. All NVD table ingestion must go through the `CVDUtil` API. This API enforces priority configurations and ensures that field-level rules are respected during record creation and updates. The primary method is `createOrUpdateCVD`. When called, it performs the following operations: - Checks the configured source priorities to determine which source may override specific fields. - Runs **process enrich with payload** to apply enrichment data according to priority rules. - Runs **process source-specific fields** to handle fields that belong exclusively to individual sources. The payload accepts a `source` field as a separate key. When a non-CVE vulnerability source maps to multiple CVEs, pass the related CVE identifiers through the `cvdlist` parameter. The API will link the CVD record to all specified CVEs. References and exploit records can also be ingested through this API. Construct the payload using `CVDUtil` first, then use it to insert the record. Vulnerability score values can come from different sources. You can configure which source to prioritize for score assignment, determining which score value takes precedence. ## Key capabilities - **Priority-based data enrichment** A two-tier priority system \(source-level and field-level\) automatically resolves conflicts when multiple sources report on the same vulnerability, ensuring the most trusted data wins. - **Extensible integration framework** Includes out-of-the-box support for authoritative databases, vulnerability scanners, and threat intelligence feeds. Additional integrations can be configured with custom source priority via the `CVDUtil` API. - **Source-specific data preservation** Raw data from each source is stored in dedicated tables, preserving full fidelity while the consolidated CVD record presents the prioritized view. - **Field update tracking** An audit trail records which source last updated each field on every CVD record. This enables transparency and troubleshooting of data provenance. - **Non-CVE to CVE mapping** Automatically handles non-CVE identifiers by mapping them to CVE records when assignments become available. Duplicate entries are deactivated. - **CVDB Overview workspace tab** A consolidated workspace view displays CVDB record details. This includes CVSS scores, EPSS data, exploit status, references, affected software, and CWE classifications.