Only 49.70% of NVD CWE Labels Match a Code-Grounded Label Across 15,556 Audited CVEs

arXiv 2608.21977·high signalXBlueskyLinkedInCopy link

CWEAgent, an auditing instrument built on a structured 'seclometry' representation capturing root cause, trigger condition, violated property, exploit mechanism, and impact, scored 85% top-1 accuracy on a curated 100-CVE benchmark. Applied to 15,556 open-source CVEs disclosed from 2017 to 2026, it found only 49.70% of NVD CWE labels exactly match the code-grounded label, with another 31.37% defensible under taxonomy ambiguity and 3.63% evidence-inconsistent likely errors. Reliability varies sharply by assigning organization and weakness type, which undermines every scanner evaluation, benchmark, and ML security tool that treats NVD CWE labels as ground truth.