To me, it sounds like think this gets at an underlying area of confusion around what vulnerabilities actually are. A vulnerability is simply an area where someone can get through the security controls that are put in place. In many contexts, this might mean that the vulnerability in question follows a specific design, like XSS or CSRF. But that isn't always the case, because the concept of a vulnerability is much more abstract.
Security as a field and a concept is really broad, and applies to systems as much as individual pieces of software. As an example, in a corporate context, every human is a vulnerability, because every human is able to disclose information or compromise security in other ways. Doors are also vulnerabilities, because attackers can enter through them and assets can accidentally exit through them. Same with trash cans, because assets could get lost in them. Toilets are the same. Of course, humans and doors and trash cans and toilets are all risks that necessarily must be accepted, but they're still vulnerabilities.
So to answer your original question, vulnerabilities don't have signatures because they are abstract and represent something intangible. They can't have signatures, because they exist as a concept at a much higher level. Viruses can have signatures, but that's because viruses are discrete pieces of software that function in an incredibly narrow way. (Note the distinction there, by the way - viruses can have signatures, but malware doesn't have signatures.)
It sounds like you might be looking for something related to vuln scanning - awesome! Vuln scanning is a super cool space! OWASP has a great list about significant vuln scanners here, so definitely check that out. There are other scanners and scanning tools not included in that last, but it's pretty comprehensive and should give you a good starting place. Virus signature databases also exist of course - I can't recommend any in specific, but searching on "virus signature database" should hopefully get you some useful results if that's what you're after. And, of course, as you mentioned, NIST has a great repository of vulnerabilities, as does MITRE.