CVE system struggling to keep pace with modern development

A new report finds that the Common Vulnerabilities and Exposures (CVE) system struggles to keep pace with the realities of modern software development. The study from Sonatype analyzed 1,552 open source vulnerabilities disclosed in 2025 and found that nearly two-thirds (64 percent) lacked severity scores from the National Vulnerability Database (NVD). “The CVE program was never built for the scale and speed of modern, component-based software development. That has been the case with open source, and is even more true with AI,” says Brian Fox, CTO and co-founder of Sonatype. “Vulnerability intelligence must shift from indexing what someone assigned yesterday,… [Continue Reading]