Blind Spots / Coverage GapsStanding
Blind spots: the AI weaknesses the standard catalogs barely use
Updated 12 August 2026 · Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 100,796 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
Why it matters
If the standard catalogs don't tag AI weaknesses, dashboards built on them under-count AI risk by construction. That gap is invisible unless someone maps it independently.
What to do
- Security leaders. Don't assume 'no AI CVEs in the feed' means 'no AI risk' — the feed may simply not tag it.
- Lean IT orgs. Track AI/ML tools as their own asset class rather than trusting CVE tags to surface them.
- MSPs. Position independent AI-risk mapping as a differentiated service clients can't get from raw feeds.
Our take
Showing where the industry-standard data is silent — and filling that silence — is the strongest possible authority play.
Earlier issues
Past states of this signal, most recent first.
08 August 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 99,003 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
03 August 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 97,489 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
29 July 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 96,070 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.
24 July 2026 Blind spots: the AI weaknesses the standard catalogs barely use
Timeframe: CVEs published in 2025 to date
Since the start of 2025, NVD has assigned an AI-specific weakness (CWE-1426, CWE-1427, or CWE-1039) to just 2 of 94,803 CVEs it published. The public taxonomy has the categories but almost nothing is mapped into them, a growing blind spot as AI software ships.