Accuracy benchmark · 25 September 2026

Frozen pre-repair result

Accuracy measured against retained first-party evidence.

We tested a reproducible, stratified sample of 200 advisories across 20 vendors. The benchmark measures whether SVXtream preserved and normalised the vendor's product, version, CVE and remediation facts correctly—not whether a field merely had the right shape.

99.98%

Fact precision

5,925 correct facts and one incorrect fact among stored assertions reviewed.

99.61%

Fact recall

Twenty-two source facts were missing from the sampled records.

200/200

Core benchmark passes

Every sampled record passed the defined relationship, CVE, guidance and evidence contract.

Vendors represented

Ten advisories were selected per vendor using the recorded sampling method.

The 200/200 result applies to the defined core relationship, CVE, guidance and evidence contract. The wider fact review found one incorrect fact and 22 missing facts across 18 advisories. It is not a claim of perfect or database-wide accuracy.

Results by measure

Applicable records passed every core field check.

Not-applicable records are shown separately and excluded from each field denominator. Confidence ranges are 95% Wilson intervals.

5,925

Correct facts

Incorrect fact

Missing facts

Unsupported facts

Measure	Pass	N/A	Rate	95% interval
Affected product/applicability	197	3	100.0%	98.1–100.0%
Affected version	145	55	100.0%	97.4–100.0%
Fixed version	157	43	100.0%	97.6–100.0%
Remediation	194	6	100.0%	98.1–100.0%
Complete advisory CVE set	194	6	100.0%	98.1–100.0%
Explicit product-scoped CVE link	192	8	100.0%	98.0–100.0%
Source-evidence chain	200	0	100.0%	98.1–100.0%

Observed defects

What the fact review found.

The expanded review found 23 defects in 18 of the 200 sampled advisories across nine vendors. The misses were concentrated in normalised impact statements, with two absent vendor scores and one incorrect product-scoped score fact.

“Missing” means the fact was absent from the normalised canonical fields at the reviewed revision. The same wording may still have been retained in free text or a source artifact.

Missing

Impact statements

Twenty source-stated impact statements were absent from normalised impact rows across 15 advisories.

Missing

CVSS scores

Two Adobe-authored CVSS 3.1 scores were absent from normalised score rows.

Incorrect

CVSS vector

One product-scoped CVSS vector used the wrong attack-complexity metric.

No identified defect in this sample involved affected or fixed version attribution, product applicability, remediation, CVE membership or source evidence.

Representative findings

These examples show the difference between a complete source statement and the normalised fields measured in the frozen review.

MissingImpact statement

Debian

DLA-4705-1

The normalised record held one impact row, but four additional vendor-stated consequences were absent: header injection, brute-force protection bypass, server-side request forgery and file disclosure or exfiltration.

MissingCVSS score

Adobe

APSB24-78

Adobe's CNA CVSS 3.1 score for CVE-2024-45145 was absent from the normalised score rows: 5.5 Medium with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

IncorrectCVSS vector

Atlassian

CVE-2025-9287

The Jira Software product score used AC:H, while its product narrative supported AC:L. The correction follows the product narrative and preserves Atlassian's conflicting structured value as a publisher conflict.

See all 18 affected advisories

Vendor	Advisory	Defect	Data affected	Finding in the frozen review
Adobe	APSB24-78	Missing	CVSS score	Adobe CNA CVSS 3.1 score for CVE-2024-45145 was absent.
Adobe	APSB25-29	Missing	CVSS score	Adobe CNA CVSS 3.1 score for CVE-2025-27197 was absent.
Atlassian	CVE-2025-9287	Incorrect	CVSS vector	The Jira Software product score used the wrong attack-complexity metric.
Amazon Web Services	2026-029-AWS	Missing	Impact statement	Linux-kernel privilege-escalation consequence was absent.
Debian	DLA-3631-1	Missing	Impact statement	X-server crash consequence and its configuration and event prerequisites were absent.
Debian	DLA-4705-1	Missing	Impact statements	Four calibre consequences were absent: header injection, protection bypass, SSRF and file disclosure or exfiltration.
Debian	DSA-6128-1	Missing	Impact statement	Possible cross-site scripting consequence in Shaarli was absent.
GitLab	GITLAB-CVE-2024-2454	Missing	Impact statement	Crafted-request denial of service in the pins endpoint was absent.
GitLab	GITLAB-CVE-2024-3114	Missing	Impact statement	Regular-expression denial of service while parsing invalid commits was absent.
GitLab	GITLAB-CVE-2026-1747	Missing	Impact statement	Unauthorized modification of protected Conan packages was absent.
Kubernetes	CVE-2020-8557	Missing	Impact statement	Node-storage exhaustion and node-failure consequence was absent.
Palo Alto Networks	CVE-2023-6789	Missing	Impact statement	Stored JavaScript execution and actions disguised as another administrator were absent.
Palo Alto Networks	CVE-2024-0010	Missing	Impact statement	Malicious JavaScript execution, phishing and possible credential theft were absent.
Palo Alto Networks	PAN-SA-2016-0006	Missing	Impact statement	URL-filter bypass with its insider-only scope and negative qualifications was absent.
Palo Alto Networks	PAN-SA-2016-0032	Missing	Impact statement	Authentication-token theft and API-call consequence with its browser-access prerequisite was absent.
Siemens	SSA-925850	Missing	Impact statement	Unauthorized cross-project queries by an authenticated Polarion ALM user were absent.
Ubuntu	USN-8183-1	Missing	Impact statement	Malicious-microcode loading and loss of integrity or confidentiality was absent.
Ubuntu	USN-8638-1	Missing	Impact statements	Three Axios consequences were absent: two SSRF statements and one HTTP-header injection statement.

Repair status

The sampled defects were restored.

The accepted repair restored all 23 sampled facts and covered related historical cases across 118 existing advisory identities. Post-write validation checked 6,420 records with no material delta, QA failure or reconstruction error.

This is repair evidence, not a post-repair rescore. The 99.98% precision and 99.61% recall figures remain the frozen pre-repair benchmark.

Methodology

Designed to be repeatable and difficult cases stayed in scope.

The benchmark deliberately revisited vendors implicated in preceding defect rounds. This tests whether corrections held while the recorded seed makes the advisory selection reproducible.

Define the eligible population

Vendors needed at least ten active advisories. The frozen canonical snapshot contained 60,643 advisories, 56,628 unique CVEs and 1,116,262 product rows.

Select a reproducible, stratified sample

Eighteen previously defect-bearing vendors were required and two were selected by ascending SHA-256 rank. Ten advisories per vendor and one relationship per advisory were ranked separately from the recorded seed.

Compare with retained vendor evidence

Each sampled relationship and the applicable advisory-wide facts were checked against retained first-party payloads. Complete CVE and CWE membership were included; external enrichment was excluded.

Freeze results before repair

The measurement was preserved before corrections. Findings could then be repaired without retrospectively improving the published benchmark result.

Recorded seed: 80c7f15d206468e4dad1e128c9765d4edd13dc2847b7bce13bec95aec120fbfb
Evidence checked: 1,094 artifact links and 1,334 retained payload hashes
Revision verification: 778 revisions covering 13,767 recorded changes

Vendor representation

Ten advisories from each of 20 vendors.

“Required” vendors were carried forward from the preceding defect round. Docker and JetBrains were selected from the remaining eligible vendors by the recorded seed. Seven passing records contained disclosed conflicts within vendor-source material.

Vendor	Selection	Eligible population	Pass	Vendor conflicts
ABB	Required	69	10	0
Adobe	Required	339	10	2
Atlassian	Required	418	10	1
Amazon Web Services	Required	179	10	0
Cisco	Required	77	10	0
Citrix	Required	24	10	1
Debian	Required	2,801	10	0
Docker	Seed-ranked	78	10	0
GitLab	Required	510	10	0
IBM	Required	1,221	10	0
Intel	Required	630	10	0
JetBrains	Seed-ranked	367	10	0
Juniper Networks	Required	30	10	3
Kubernetes	Required	91	10	0
NVIDIA	Required	172	10	0
Oracle Linux	Required	4,949	10	0
Palo Alto Networks	Required	177	10	0
Red Hat	Required	7,112	10	0
Siemens	Required	593	10	0
Ubuntu	Required	1,307	10	0

A vendor-source conflict records contradictory or inconsistent first-party material. It remains visible in the data and does not count as an SVXtream failure when the source conflict is represented accurately.

What the result does not claim

Limitations are part of the result.

Publishing the boundaries prevents a sample result from being mistaken for a universal guarantee or an independent certification.

This is a point-in-time sample, not evidence that every record in the database is correct.
The vendor sample is stratified: 18 vendors were carried forward from the preceding defect round and two were seed-ranked.
One product relationship per advisory was scored; unselected product rows were not comprehensively reviewed.
The review was performed by a coding agent rather than an independent named human or audit firm.
Retained snapshots do not measure changes subsequently made to live vendor pages.

Test the evidence against your own priority vendors.

Choose three vendors and compare representative SVXtream records with the first-party publications and your existing advisory workflow.

Request an enterprise evaluation