Would like to ask currently, is the National Vulnerability Database (NVD) still the place to go if you want to search for update vulnerabilities for different products? I find that some product vulnerabilities are not found in the NVD database. For example, I search for "Sitefinity" and it gives me no results. But when I do a search on Google, I found something on osdir. Is there another alternative vulnerability database that you know of that is more updated?
closed as primarily opinion-based by TildalWave, Ayrx, Xander, Rоry McCune, Scott Pack Jul 14 '15 at 19:04
Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.
NVD is an authoritative source for vulnerabilities reported to them. They do not list vulnerabilities that merely exist in the wild.
So, yes, the NVD is a fine place to go, but it is never going to be fully complete. Not every vulnerability is issued a CVE.