I think a tricky thing about these metrics is GitHub and the Linux Kernel became their own CNA in mid-2024[1] and mid-2025[2]. This caused a bunch of new automation and lowered barriers to actually filing a CVE.
As a small data point I have a >20k downloads Obsidian plugin and it got a CVE on a Beta release due to a bad pathing regex. I feel this would have never happened 2 years ago.
So, I feel the bar for a CVE being issued is WAYYYY lower in 2025+ than before.
Severities are not directly comparable. The CVSS docs leave the choice of the "vulnerable component" as an exercise for the reader. The choice of the "vulnerable component" is also not encoded in the score so a critical may be a critical in the context of a library scored against a theoretical (and bad) program or it could be scored on a single website with known mitigations.
Thanks for the link!
1) It seems some are coming down, like RedHat
2) This pattern should be expected based on the amount of "intelligent" compute, heuristic agentic algorithms, money and awareness on the issue of software vulnerabilities at the moment. Projects like Glasswing, Daybreak, Fairwind, Purple etc are in full swing and seemingly effective
It’s impressive that the number of CVEs issued the last two years has skyrocketed, given how badly DOGE gutted the cybersecurity [0] agencies. Unfortunately we don’t know how huge the backlog may have since grown
DOGE was impressively criminal. The team tried to remove the CVE reporting system entirely and only failed to do so because of intevention from the military and several agencies.
1) the government is currently doing the work and the work is critical. Yoinking the system without any replacement causes catastrophic consequences that reduce profits (and maybe get a few folks killed, but really, think of the bottom line.) Anyways, if you want to transition a critical component you do so with a plan.
2) It is critically necessary for the CVE system to be trusted by many entities worldwide. The government has historically not played favorites and had that trust. This is still mostly true. No for-profit commercial entity has that same level of trust; the for-profit model removes the ability for that trust to truly be universal.
The CVE system is far, far from perfect and NIST has faced increasing criticism (even before 2025) about its ability to triage and process the backlog. But I don't think their role is limited to simply posting what’s sent to them?
The name is amusingly often misunderstood in Germany as a French government agency (this is anecdata, I‘ve just heard that several times in the last few months). It just sounds French, I guess.
I remember a comment somewhere, where employees of a company, would open a CVE for a piece that they use in their job, to force an upgrade of said software since normal update request has been denied despite having business reasons to do so. So, the number doesn't matter.
Also, the linux kernel assigns CVE for anything that can be though as a vulnerability:
> Note, due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team
Cool. This would be easier to interpret with a log scale. There's an option for it, but clicking it doesn't change the chart and freezes the site for me.
Others have pointed out that we thought we would get security vulnerability from AI code, but it turns out AI is uncovering vulnerabilities in decades of human code.
They aren't mutually exclusive. Wait until we find out intelligence services have been influencing the output of AI generated code for certain people/counties.
Is the point that you're making that it only found the vulnerabilities because they were in the training set, and therefore AI didn't really "find" them?
If so, I fear you're making the opposite point, which is that AI made genuinely new discoveries that were not in its training set, about codebases that were in its training set. It quite literally expanded the horizon of what we know.
philips 1 day ago
As a small data point I have a >20k downloads Obsidian plugin and it got a CVE on a Beta release due to a bad pathing regex. I feel this would have never happened 2 years ago.
So, I feel the bar for a CVE being issued is WAYYYY lower in 2025+ than before.
[1]: http://www.kroah.com/log/blog/2024/02/13/linux-is-a-cna/
[2]: https://github.blog/security/vulnerability-research/how-to-r...
DeepYogurt 1 day ago
https://github.blog/security/vulnerability-research/removing...
0xOsprey 11 hours ago
0xOsprey 1 day ago
tomxor 1 day ago
But then I found this:
https://craci.com/resources/CVE-publication-trends?sev=criti...
Trend for critical CVEs is actually worse, at roughly 25x that of 2020, compared to all CVEs which are roughly 5x compared to 2020.
DeepYogurt 1 day ago
mxey 21 hours ago
arbirk 23 hours ago
tetha 20 hours ago
After all, what would all that hardware and research be worth it, if it didn't find the most critical vulnerabilities around?
0xOsprey 1 day ago
danso 1 day ago
[0] https://www.securityweek.com/mitre-signals-potential-cve-pro...
SimianSci 1 day ago
MetaWhirledPeas 1 day ago
Honest question: what would be the criminal purpose for that?
farnsworth 1 day ago
AnneTrotter 20 hours ago
1) the government is currently doing the work and the work is critical. Yoinking the system without any replacement causes catastrophic consequences that reduce profits (and maybe get a few folks killed, but really, think of the bottom line.) Anyways, if you want to transition a critical component you do so with a plan.
2) It is critically necessary for the CVE system to be trusted by many entities worldwide. The government has historically not played favorites and had that trust. This is still mostly true. No for-profit commercial entity has that same level of trust; the for-profit model removes the ability for that trust to truly be universal.
Vaushite 1 day ago
kridsdale1 1 day ago
lawn 1 day ago
jpadkins 19 hours ago
vasco 1 day ago
danso 1 day ago
https://www.securityweek.com/cve-and-nvd-a-weak-and-fracture...
vasco 1 day ago
theteapot 1 day ago
Tomte 19 hours ago
koolba 20 hours ago
braiamp 1 day ago
Also, the linux kernel assigns CVE for anything that can be though as a vulnerability:
> Note, due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team
In other words, the number is fake
red75prime 1 day ago
In other words, the method of assigning CVEs hasn't changed, but the number of CVEs has risen sharply.
braiamp 1 day ago
philips 1 day ago
dgacmu 1 day ago
k2enemy 1 day ago
0xOsprey 1 day ago
The irony of my vibe coded personal site going viral because the site I was using historically was down due to P2PShell...
https://x.com/0x_Osprey/status/2113152597767172346
haaz 1 day ago
xnx 1 day ago
fbelzile 1 day ago
cowlevel 1 day ago
https://www.crowdstrike.com/en-us/blog/crowdstrike-researche...
DeepYogurt 1 day ago
n2d4 1 day ago
If so, I fear you're making the opposite point, which is that AI made genuinely new discoveries that were not in its training set, about codebases that were in its training set. It quite literally expanded the horizon of what we know.