Scanners often skip a CVE because their data source treats it as unreviewed. In the GitHub Advisory Database, unreviewed advisories come straight from the NVD feed without validity or completeness checks, and alerts are generated only for reviewed ones. A skipped CVE can be a policy choice, a data gap or both.
Definitions
Reviewed advisory. One that GitHub has checked for validity, with a full description and package and ecosystem information, mapped to a supported ecosystem. Per GitHub's documentation, alerts are generated for these.
Unreviewed advisory. One published automatically from the NVD feed, with no validity or completeness check. No alerts are created for these.
Supported ecosystems. The documentation lists Composer, Erlang, Go, GitHub Actions, Maven, npm, NuGet, Pip, Pub, RubyGems, Rust and Swift.
Why this matters when choosing a scanner
Every scanner has to decide how to handle records of uneven quality. Some drop low quality records to cut noise. Some include everything and let you filter. Neither is wrong, but the choice changes what you see. When you compare an open source scanner and a managed platform, you are partly comparing these choices.
| Approach | Upside | Downside |
|---|---|---|
| Only reviewed or curated records | Fewer false alarms | May miss a real issue that has not been reviewed yet |
| Everything, including raw feed records | Wider coverage | More noise, more triage work |
| Curated plus a flagged raw tier | Balance, if clearly labelled | Needs a clear way to display confidence |
How to find out what your tool does
- Read the documentation section on data sources, or ask your vendor in writing.
- Find a recent CVE that exists in NVD but has no ecosystem advisory yet. Check whether your scanner shows it.
- Look for a field or label that tells you the record's origin or confidence.
- Decide your policy. For example, treat unreviewed records as informational unless they appear in the CISA KEV catalog, which the CISA page describes as a source of vulnerabilities exploited in the wild.
- Write the policy down so a new team member does not reverse it by accident.
What to do about a gap
If a CVE affects you and your scanner skipped it, do not just add an ignore rule in reverse. Open an issue with the maintainers or your vendor, include the package, version and advisory id, and note the date. Anyone can also propose improvements to an advisory through a pull request to the advisory database repository, which the GitHub Security Lab curation team reviews, according to the documentation. That is a real exit from waiting.
Keep the loop owned
Name one person who watches these gaps. Without an owner, skipped CVEs become folklore: someone remembers a miss, but nobody can say how often it happens.
Safeguard can scan your dependencies and show the evidence behind each finding. You can try it free at gold.safeguard.sh/scan.
Quick check
Is an unreviewed advisory the same as a false positive?
No. It means the record has not passed a completeness check. It may be accurate or not, so treat it as a lead to verify.
Does the KEV catalog replace advisory databases?
No. KEV lists vulnerabilities known to be exploited in the wild. It is an input to prioritisation, not a full inventory of vulnerable package versions.
Sources
Last reviewed: 19 October 2026.
