A meaningful slice of open source advisories carry no CVE ID. In OSV exports from 19 October 2026, 41.3 percent of crates.io advisories and 14.7 percent of npm advisories list no CVE alias. If your process keys on CVE IDs, those vulnerabilities never reach it.
Method
We downloaded eight OSV ecosystem exports on 19 October 2026 and kept vulnerability advisories (excluding MAL- records and withdrawn ones). We counted an advisory as having no CVE if none of the IDs in its aliases list begins with CVE-. The record's own ID (for example a GHSA, PYSEC, GO or RUSTSEC ID) is separate from aliases.
Limit: a CVE may be assigned later, so today's gap can shrink. We measured a snapshot.
What the numbers say
| Ecosystem | Advisories | With no CVE alias | Share |
|---|---|---|---|
| crates.io | 2,799 | 1,156 | 41.3% |
| npm | 7,447 | 1,095 | 14.7% |
| Packagist | 7,147 | 873 | 12.2% |
| Go | 9,464 | 666 | 7.0% |
| NuGet | 1,142 | 55 | 4.8% |
| RubyGems | 1,091 | 35 | 3.2% |
| PyPI | 13,941 | 343 | 2.5% |
| Maven | 7,077 | 96 | 1.4% |
In Maven, PyPI, RubyGems and NuGet the gap is small. In crates.io it is large, and npm and Packagist have gaps of one in eight or more.
In absolute terms, that is 4,319 advisories across the eight ecosystems with no CVE alias, of which 1,156 are crates.io and 1,095 are npm.
Why it matters
A lot of vulnerability tooling, reporting and policy is keyed on CVE IDs. A policy that says "block anything with a CVE above 7.0 and a fix" will not see an advisory that has no CVE. A report titled "CVEs in our dependencies" undercounts. A spreadsheet that tracks CVE IDs as primary keys has no row for the advisory.
Three changes close the gap:
- Match on package name and version range, not on CVE ID. OSV records are built for that.
- Key your tracking on the advisory ID (GHSA, RUSTSEC, GO, PYSEC and so on) and store CVE as an optional alias.
- When you report counts, say whether you count advisories or CVEs. They are not the same number, as the next analysis on duplicate advisories shows.
If you are in crates.io or npm, check your tooling first, because that is where the gap is largest.
Safeguard's SBOM and dependency scanning matches components against advisory data by package and version, and the free scan at https://gold.safeguard.sh/scan shows what a manifest turns up.
Try it yourself
Open the demo and look at how components are matched to findings from a dependency inventory.
Click through it at your own pace, or open it full screen.
Quick check
Is an advisory without a CVE less serious?
Not by that fact alone. It means no CVE ID is listed as an alias. Judge it on severity, reachability and fix status.
What should I key my tracking on?
The advisory ID, with CVE as an optional alias, so records without a CVE still get tracked.
Sources
- OSV data sources and per-ecosystem downloads, fetched 19 October 2026
- OSV schema, fetched 19 October 2026
Last reviewed: 19 October 2026.
