# Trust Issues: The CVE Crisis

A look at whether the world’s vulnerability index still delivers real security intelligence

## Download Your Copy

Despite serving as the backbone of global vulnerability management, CVE and NVD data is increasingly incomplete, inconsistent, and delayed — creating a misleading sense of confidence for security teams, tools, and automated pipelines. Based on Sonatype’s analysis of 1,552 open source CVEs, the report reveals systemic breakdowns across severity scoring, advisory accuracy, and timeliness that limit effective risk prioritization and modern software governance.

### Read the report to learn:

- Why **64% of open source CVEs lacked a CVSS score** in 2025
- How **only 19% of CVE severity categories matched** across sources, challenging prioritization confidence
- The surprising impact of **62% of overstated severity scores** and widespread false positives and negatives
- How scoring delays — averaging **six weeks**, sometimes **50+** — expand the exploit and decision-making window