CVE System Fails to Score Majority of Vulnerabilities

A report by Sonatype reveals that the Common Vulnerabilities and Exposures (CVE) system is unable to score nearly two-thirds (64%) of the 1,552 open source vulnerabilities disclosed in 2025. This inadequacy affects the ability of organizations to assess and prioritize security risks effectively. The findings indicate a growing disconnect between the CVE system and the rapid pace of modern software development.