The NVD (National Vulnerability Database) is the US government’s public database of vulnerabilities, run by NIST. It lists CVEs and adds a severity score (CVSS) and technical details. Most vulnerability scanners and patch tools rely on it.

How can I detect exploitation of a vulnerability before the CVE is published?

Watch for attackers probing the product, not for a CVE number. Reconnaissance rules detect scans that target a product family (for example, requests that only make sense against a specific appliance or plugin). When that probing rises, a vulnerability is often about to be exploited or already is. The CrowdSec Live Exploit Tracker shows this activity and the IPs behind it, so you can block them before the CVE appears.

Why not just wait for the NVD?

Because the NVD runs behind. This year it has received 84,597 new CVEs and analyzed 40,770 of them, and 57,115 sit in “deferred” status (NVD dashboard, October 2026). Attackers don’t wait for that analysis: CrowdSec saw CVE-2025-2748 exploited 42 days before the research was published.

Is pre-NVD detection the same as zero-day detection?

No. Zero-day detection is about flaws with no fix yet. Pre-NVD detection is about seeing attack activity before a vulnerability is listed in the NVD, which also covers flaws the vendor already knows about and may have patched.

What Is Pre-NVD Detection? Seeing Attacks Before the CVE

Pre-NVD detection means spotting attack activity against a technology before the vulnerability behind it is published in the NVD, the US National Vulnerability Database where CVEs are listed and scored. Instead of waiting for a CVE, a CVSS score, or a KEV entry, you watch what attackers are probing right now.

Why it matters

Most vulnerability tools start from the NVD: no CVE, no alert. Attackers don’t wait for it. They map products first (which servers run Exchange, F5 BIG-IP, or a given WordPress plugin), and some exploit flaws weeks before anyone writes about them. In 2025, CrowdSec saw five AWS IPs exploiting CVE-2025-2748 42 days before the research was published.

How CrowdSec does it

The Live Exploit Tracker runs reconnaissance rules on signals from more than 250,000 active Security Engines. Each rule detects probing of a product family, not of one CVE. When a new vulnerability lands, you already know who was scanning for that product, and a firewall subscribed to the vendor has already blocked those IPs.

Pre-NVD vs zero-day

A zero-day is a flaw exploited before a fix exists. Pre-NVD is about timing of knowledge: activity seen before the vulnerability is public in the NVD, whether it’s a true zero-day or a flaw already known to its vendor.