The mix of weaknesses behind open source advisories differs sharply by ecosystem. In OSV exports from 19 October 2026, cross-site scripting makes up 33.0 percent of CWE-tagged Packagist advisories, out-of-bounds write 19.8 percent of NuGet's, and path traversal leads Go. Review effort should follow your stack.
Method
We downloaded eight OSV exports on 19 October 2026 and kept vulnerability advisories (excluding MAL- and withdrawn records). We counted CWE IDs from database_specific.cwe_ids. Shares are of advisories that have at least one CWE tag, not of all advisories. Coverage of tags varies a lot (see below), so the shares are only as good as the tagging.
What the numbers say
| Ecosystem | Advisories with a CWE tag | Top CWE | Share of tagged |
|---|---|---|---|
| Packagist | 85.4% | CWE-79 cross-site scripting | 33.0% |
| NuGet | 94.0% | CWE-787 out-of-bounds write | 19.8% |
| RubyGems | 94.3% | CWE-79 cross-site scripting | 18.6% |
| Maven | 97.1% | CWE-79 cross-site scripting | 14.0% |
| npm | 97.6% | CWE-79 cross-site scripting | 12.4% |
| PyPI | 44.0% | CWE-79 cross-site scripting | 8.4% |
| Go | 49.8% | CWE-22 path traversal | 7.7% |
| crates.io | 46.7% | CWE-362 race condition | 5.7% |
A few details stand out.
In npm, the next entries after XSS are CWE-22 path traversal (7.7 percent) and CWE-1321, prototype pollution (7.6 percent). CWE-506, embedded malicious code, appears 402 times among npm vulnerability advisories, 5.5 percent.
In Maven the second tag is CWE-502 deserialization (6.0 percent), which fits a language where object serialization is common.
In NuGet, the memory weaknesses CWE-787 and CWE-119 together make up more than a quarter of tags (19.8 and 6.8 percent), which likely reflects native libraries wrapped in packages. We did not verify that explanation.
In crates.io the leaders are race conditions, use after free (CWE-416, 5.3 percent) and resource exhaustion, a different profile from the web-heavy ecosystems.
Tag coverage
PyPI, Go and crates.io tag fewer than half of their advisories with a CWE (44.0, 49.8 and 46.7 percent). Their top shares are therefore based on a minority of records, and could shift if the rest were tagged.
What to do with it
Use the table to focus review, not to rank ecosystems. If you ship PHP, your largest recurring risk class in dependencies is script injection, so output encoding and a strict content security policy pay back. If you ship .NET with native imaging or parsing libraries, memory safety fixes in those packages deserve fast updates. If you ship npm packages, add prototype pollution to your code review checklist, and treat any package that parses user supplied JSON into objects as a hotspot.
For your own code, the same logic applies in reverse: the classes that fill advisory feeds are the ones other teams keep writing.
Safeguard's SBOM and dependency scanning covers the dependency side of this, and the free scan at https://gold.safeguard.sh/scan shows what one repository pulls in.
Quick check
Does a higher XSS share mean a language is less secure?
No. It reflects what gets reported and tagged, and the kinds of software published in that ecosystem.
Why are the PyPI, Go and crates.io shares less reliable?
Fewer than half of their advisories carry a CWE tag, so the shares rest on a minority of records.
Sources
- OSV data sources and per-ecosystem downloads, fetched 19 October 2026
- OSV schema, fetched 19 October 2026
Last reviewed: 19 October 2026.
