Many open source advisories have no severity label at all. In OSV exports from 19 October 2026, 54.5 percent of PyPI advisories, 48.6 percent of Go and 46.2 percent of crates.io carry no rating, while npm, Maven, NuGet and RubyGems carry one on essentially all. Unrated does not mean low.
Method
We downloaded eight OSV exports on 19 October 2026 and kept vulnerability advisories (excluding MAL- and withdrawn records). We read the label in database_specific.severity, which holds LOW, MODERATE, HIGH or CRITICAL where present. We did not read CVSS vectors from the severity array, so records that carry a vector but no label count as unrated here.
That is a real limit: some unrated records may have a CVSS score elsewhere in the record. We report the label because it is what many tools show first.
What the numbers say
| Ecosystem | Advisories | Unrated | HIGH or CRITICAL, as share of rated |
|---|---|---|---|
| PyPI | 13,941 | 54.5% | 51.2% |
| Go | 9,464 | 48.6% | 48.5% |
| crates.io | 2,799 | 46.2% | 50.4% |
| Packagist | 7,147 | 9.9% | 38.6% |
| npm | 7,447 | 0.0% | 59.0% |
| NuGet | 1,142 | 0.0% | 57.8% |
| Maven | 7,077 | 0.0% | 46.7% |
| RubyGems | 1,091 | 0.0% | 45.8% |
Read the last column with care. It is a share of advisories that have a label, and different ecosystems label different sets of flaws. A higher share in npm does not show that npm flaws are worse. It shows that the labelled advisories skew high, and the unlabelled population is absent.
The pattern is clean. In PyPI the 7,587 records with PYSEC IDs are all unrated, and the 6,343 GitHub advisories are all rated, apart from 11 records with OSV IDs. In Go the 4,595 records with GO IDs are all unrated, in crates.io the 1,294 RUSTSEC records are, and in Packagist the 709 Drupal records are. So the gap comes from the native ecosystem databases, which do not assign this label, not from random omissions.
What to do with unrated findings
A severity gate that reads only the label will let unrated findings through, because they match no threshold. That is the risky default. Three safer ones:
- Treat unrated as unknown, not low. Put them in a review queue with an owner.
- Fill the gap from other signals. A linked CVE record may carry a CVSS score. Exploitation signals such as the KEV catalog and EPSS add context. Reachability tells you whether your code calls the flawed path.
- Write the gate rule explicitly. For example, "block critical with a fix; send unrated to review". Do not rely on what a missing field happens to do.
If you report severity counts to leadership, add an "unrated" row. A chart that drops them understates the backlog in exactly the ecosystems where the gap is largest.
Safeguard policies and gates let you set a rule for the unrated case on its own, instead of letting it fall through a severity threshold.
Try it yourself
Open the demo and look at how a pull request gate decides which findings to block and which to pass.
Click through it at your own pace, or open it full screen.
Quick check
Is an unrated advisory low risk?
No. It has no label, which is different from a low label. Look for other signals and review it.
Why do some ecosystems have no unrated records?
Their advisories come almost entirely from GitHub advisories, which carry a label on every record in these exports.
Sources
- OSV data sources and per-ecosystem downloads, fetched 19 October 2026
- OSV schema, fetched 19 October 2026
Last reviewed: 19 October 2026.
