CVE Tracker

It’s impressive that the number of CVEs issued the last two years has skyrocketed, given how badly DOGE gutted the cybersecurity [0] agencies. Unfortunately we don’t know how huge the backlog may have since grown

[0] https://www.securityweek.com/mitre-signals-potential-cve-pro...

I was suspicious the absence of a severity filter was exaggerating the trend...

But then I found this:

https://craci.com/resources/CVE-publication-trends?sev=criti...

Trend for critical CVEs is actually worse, at roughly 25x that of 2020, compared to all CVEs which are roughly 5x compared to 2020.

Cool. This would be easier to interpret with a log scale. There's an option for it, but clicking it doesn't change the chart and freezes the site for me.

Avalanche on Mount Tech Debt?

This is what AI companies meant by embracing the exponential?

I remember a comment somewhere, where employees of a company, would open a CVE for a piece that they use in their job, to force an upgrade of said software since normal update request has been denied despite having business reasons to do so. So, the number doesn't matter.

Also, the linux kernel assigns CVE for anything that can be though as a vulnerability:

> Note, due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team

In other words, the number is fake

Thanks for this. I’m going to send it on our #general on Slack so people might understand when I say I’m a “bit” busy at the moment…

12,000 CVEs? That doesn't match the data in the source at the bottom. I cloned it and for 2026 there are 79,764 CVE json files. I'm pretty sure I patched more than 12,000 CVEs for my RHEL systems this year. Also the site freezes for me as well when switching to logarithmic.