“Unread” tracks CVEs that arrived in the dataset after you last pressed Mark all read; opening a CVE marks it read.