NVD Disruptions Force Security Teams to Diversify Vulnerability Intelligence Sources
The vulnerability management process begins with reliable information about which vulnerabilities exist. Over the past couple of years the ecosystem of vulnerability data sources has experienced a genuine earthquake. What once seemed permanent and unshakable — a single CVE database carefully enriched by the American NVD — has suddenly become unstable. This article examines where to obtain vulnerability data today and why depending on one source has become risky.
Primary Vulnerability Data Sources for the Russian Market
BDU FSTEC (bdu.fstec.ru) is the Russian national threat database. Its advantages include orientation toward the Russian market and legislation, official state-recognized data, detailed descriptions with remediation recommendations, and coverage of domestic software that may be absent from Western databases. As of August 2026 the database contains more than 92 thousand vulnerabilities. Entries use identifiers in the format BDU:2024-01398. Users can find descriptions, consequences, and mitigation guidance. FSTEC also maintains a separate section on the most dangerous trending vulnerabilities, serving as the Russian analogue of the catalog of exploited vulnerabilities.
NVD (nvd.nist.gov), maintained by NIST, is the American national vulnerability database. It offers broad coverage, detailed descriptions, and mappings to CVSS and CPE. However, NVD has been at the center of the main drama of recent years, which is discussed below.
The CVE database maintained by MITRE is the international registry of vulnerability identifiers. CVE serves as the global identification standard; the same identifier CVE-2021-44228 (Log4Shell) is recognized worldwide. Both NVD and BDU, as well as vendor products, rely on CVE records.
Vendor security bulletins from software manufacturers such as Microsoft, Cisco, Astra Group, Positive Technologies and others frequently provide the earliest and most accurate information.
Related articles
The Birth of CVE: How Two MITRE Engineers Built the Universal Vulnerability Identifier in 1999
In the late 1990s, security teams faced chaos with one vulnerability carrying dozens of incompatible names across scanners, IDS tools, and CERT advisories. Two MITRE engineers, David E. Mann and Steven M. Christey, proposed a minimal Common Vulnerabilities and Exposures list to solve correlation problems without imposing taxonomy or risk models. Their January 1999 paper led to a Purdue workshop, the formation of the CVE Editorial Board, and a public launch on September 29, 1999, with 321 initial entries. The design deliberately avoided ownership by any vendor and kept names as simple CVE-year-number strings. This neutral, open approach allowed competing vendors to map their proprietary databases to a shared reference without agreeing on classifications. The same minimalist philosophy later influenced NVD, OSV, and GitHub Advisory Database.
OnePlus 13R Preinstalled Account App Leaks Cloud Session Tokens to Any App Declaring Required Permission
Researchers at Doyensec identified a vulnerability in the preinstalled com.oneplus.account application on the OnePlus 13R that allows any third-party app to steal a valid OnePlus Cloud session token. The flaw stems from the OPAccountProvider component lacking the protectionLevel="signature" attribute on its declared permission com.oneplus.account.READ_ACCOUNT_INFO, enabling any app to request the permission and query the provider directly. Once obtained, the token grants access to OnePlus Cloud APIs without further user interaction or warnings. Doyensec responsibly disclosed the issue on 30 December 2025, leading OnePlus to acknowledge the high-severity problem and pay a $720 bounty in March 2026. Follow-up testing in September on firmware CPH2691_16.0.10.500(EX01) confirmed the token leakage persists, although full account takeover via the regional API was no longer reproducible for US and EMEA accounts due to backend changes. Users are advised to avoid untrusted apps and apply future updates, while OnePlus needs only to add the signature protection level to close the exposure.
Microsoft Fixes Remote Code Execution Flaw in Windows Remote Desktop Client
Microsoft has addressed a remote code execution vulnerability in the Windows Remote Desktop Client tracked as CVE-2026-69485 with a CVSS score of 8.8. The flaw stems from the use of an uninitialized resource and can be triggered by a specially crafted network request from an authenticated attacker with low privileges. Exploitation requires no user interaction such as clicking links or opening files and can lead to information disclosure, file modification, or service disruption. Multiple versions of Windows 10, Windows 11, and Windows Server 2016 through 2025 are affected, including Server Core installations. The issue was not publicly disclosed prior to patching and no active exploitation has been observed. Fixes were released in the September security updates including KB5124008 and KB5122871.
CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog Including Cisco FMC and Fortinet FortiOS
The US Cybersecurity and Infrastructure Security Agency has added four vulnerabilities to its Known Exploited Vulnerabilities catalog, warning that they are being actively exploited in the wild. The flaws affect Cisco Secure Firewall Management Center, Security Cloud Control, Fortinet FortiOS, FortiSwitchManager, and Citrix NetScaler products. One vulnerability allows attackers to bypass authentication and gain root privileges through crafted HTTP requests. Another is a heap-based buffer overflow that enables execution of unauthorized code or commands via specially crafted packets. CISA issued the update on September 9, 2026, urging organizations to apply patches immediately. The agency continues to track these issues as part of its ongoing efforts to mitigate real-world threats.