Trust Issues: The CVE Crisis

A look at whether the world’s vulnerability index still delivers real security intelligence

Download Your Copy

Despite serving as the backbone of global vulnerability management, CVE and NVD data is increasingly incomplete, inconsistent, and delayed — creating a misleading sense of confidence for security teams, tools, and automated pipelines. Based on Sonatype’s analysis of 1,552 open source CVEs, the report reveals systemic breakdowns across severity scoring, advisory accuracy, and timeliness that limit effective risk prioritization and modern software governance.

Read the report to learn:

• Why 64% of open source CVEs lacked a CVSS score in 2025
• How only 19% of CVE severity categories matched across sources, challenging prioritization confidence
• The surprising impact of 62% of overstated severity scores and widespread false positives and negatives
• How scoring delays — averaging six weeks, sometimes 50+ — expand the exploit and decision-making window