No ecosystem's advisory data is complete on every field. In OSV exports from 19 October 2026, PyPI lacks a summary on 28.5 percent of advisories, crates.io lacks a CVE alias on 41.3 percent, and Go has no severity label on 48.6 percent. Know the gaps in the data you depend on, then fill them from other sources.
Method
We downloaded eight OSV exports on 19 October 2026. Withdrawn counts use all records in the file. All other columns use live vulnerability advisories only (not MAL- records, not withdrawn). Definitions: missing summary means an empty summary field. CWE coverage means at least one ID in database_specific.cwe_ids. Unrated means no database_specific.severity label. No CVE means no CVE in aliases. No fix means no fixed event in any range.
The scorecard
| Ecosystem | Advisories | Missing summary | CWE coverage | Unrated | No CVE alias | No fix recorded |
|---|---|---|---|---|---|---|
| npm | 7,447 | 0.0% | 97.6% | 0.0% | 14.7% | 20.4% |
| PyPI | 13,941 | 28.5% | 44.0% | 54.5% | 2.5% | 11.6% |
| Go | 9,464 | 0.0% | 49.8% | 48.6% | 7.0% | 12.2% |
| Maven | 7,077 | 0.0% | 97.1% | 0.0% | 1.4% | 15.8% |
| NuGet | 1,142 | 0.0% | 94.0% | 0.0% | 4.8% | 4.6% |
| Packagist | 7,147 | 9.9% | 85.4% | 9.9% | 12.2% | 12.9% |
| RubyGems | 1,091 | 0.0% | 94.3% | 0.0% | 3.2% | 6.1% |
| crates.io | 2,799 | 0.0% | 46.7% | 46.2% | 41.3% | 25.0% |
Withdrawn records, as a count and a share of all records in each file: npm 730 (0.3 percent), PyPI 617 (2.3), Go 177 (1.8), Maven 113 (1.6), NuGet 41 (2.1), Packagist 155 (2.1), RubyGems 69 (1.3), crates.io 124 (4.2). The npm share is low partly because its file is mostly malicious package records, which makes the denominator large.
Reading the table
Three patterns.
The ecosystems built mostly on GitHub advisories (npm, Maven, NuGet, RubyGems) look complete on summary, severity and CWE. Their remaining gaps are CVE aliases (npm) and fixed versions (npm, Maven).
The ecosystems with their own databases beside GitHub (PyPI, Go, crates.io) have large gaps in severity and CWE. The unrated records are exactly the native ones: PYSEC in PyPI, GO in Go, RUSTSEC in crates.io. They also contain duplicates of GitHub records.
Packagist sits between the two. The 709 records with Drupal IDs are the ones with no severity label, and the missing summaries total the same 9.9 percent.
Compensating for gaps
- Missing severity: use KEV and EPSS, a linked CVE's CVSS score, and reachability. Do not treat blank as low.
- Missing CWE: do not group by weakness without saying how many records are untagged.
- Missing CVE: key on advisory IDs and match by package and version.
- Missing fix: follow a no-fix playbook of upstream check, reachability, mitigation, replacement, documented acceptance.
- Withdrawn: drop withdrawn records on each refresh, and re-open any finding that came only from a withdrawn advisory.
Each gap has a separate post in this series with more detail, including unrated advisories and advisories without CVE IDs.
Quick check
Which ecosystem has the most complete data?
By this scorecard, npm, Maven, NuGet and RubyGems are most complete on summary, severity and CWE. No ecosystem is complete on every column.
What happens to a finding when its advisory is withdrawn?
It should drop out on the next refresh. Check that your tooling does this, and that closed tickets note the reason.
Sources
- OSV data sources and per-ecosystem downloads, fetched 19 October 2026
- OSV schema, fetched 19 October 2026
Last reviewed: 19 October 2026.
