I am aware that there is the CVE list published by the NVD. Are there any other important vulnerabilities lists that show vulnerabilities other than the NVDs?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
NVD covers a lot of vulnerabilities. Aside from those you also have:
They are often linked back to NVD CVE. Another interesting project to follow is vFeed which provides cross linking between vendors and CVE vulnerabilities.
Note that this covers disclosed vulnerabilities. There are still a lot of vulnerabilities which might not get disclosed.
Currently the NVD only pulls from the Mitre CVE database, this will be changing, but for now if Mitre doesn't have an entry written up, it won't be in the NVD database. As for Mitre I know we (Red Hat) have assigned over a thousand CVEs that aren't in the Mitre Database, and even some of the CVEs Mitre assigns (e.g. on oss-security@ mailing list) aren't in the database after weeks/months, there's a huge backlog.
The good news is that for Open Source at least the DWF Project (Distributed Weakness Filing Project https://distributedweaknessfiling.org) will be addressing this and more.
Just to complementing @Kurt's answer: Just as he has commented about [NIST] NVD (National Vulnerability Database) which is an U.S. government repository vulnerability database, another vulnerability database that is provided by the MITRE Corp itself is "CVEDetails.com".
Aside from MITRE Corporation and other government resources, there are several others that I not know every of them, but I will list the bests I know:
The first one is IBM XForce Exchange1. This is one of the place where you can track vulnerabilities before it is published on MITRE CVE. The other source that are not so rare to leak some receive information about whose vulnerability is SecList2 because some people that discover the software flaw chooses to send an e-mail to Seclist before announce at
cve.mitre.org – it required a subscription to take the alert on your e-mail.
The others sources are:
Caution: If you want to consume some information of these vulnerabilities databases mentioned above, I recommend you read their terms of conditions before use it to avoid some trouble.