Blind Spots / Coverage GapsStanding
Blind spots: the AI weaknesses the standard catalogs barely use
Updated 11 October 2026 · Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 133,588 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
Why it matters
If the standard catalogs don't tag AI weaknesses, dashboards built on them under-count AI risk by construction. That gap is invisible unless someone maps it independently.
What to do
- Security leaders. Don't assume 'no AI CVEs in the feed' means 'no AI risk' — the feed may simply not tag it.
- Lean IT orgs. Track AI/ML tools as their own asset class rather than trusting CVE tags to surface them.
- MSPs. Position independent AI-risk mapping as a differentiated service clients can't get from raw feeds.
Our take
Showing where the industry-standard data is silent — and filling that silence — is the strongest possible authority play.
Earlier issues
Past states of this signal, most recent first.
11 October 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 129,017 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
06 October 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 127,172 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
01 October 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 124,980 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
26 September 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 123,073 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
21 September 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 120,630 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
16 September 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 118,413 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
11 September 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 115,215 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
06 September 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 111,667 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
01 September 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 110,101 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
27 August 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 108,614 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
22 August 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 106,542 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
17 August 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 103,312 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.