Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • I prefer the tornado

    https://rogolabs.net/tornado/

    by DeepYogurt
  • I remember a comment somewhere, where employees of a company, would open a CVE for a piece that they use in their job, to force an upgrade of said software since normal update request has been denied despite having business reasons to do so. So, the number doesn't matter.

    Also, the linux kernel assigns CVE for anything that can be though as a vulnerability:

    > Note, due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team

    In other words, the number is fake

    by braiamp
  • Not the topic (the site is interesting), but a tangential rant.

    I think the whole CVE/CVSS system is completely outdated, and it doesn't reflect the reality of software making for a while now (years). Also. for years, major software providers have been fighting to control their own release logs and security vulnerabilities. Recently, NIST stopped actually analyzing CVE's (one can relate to that), and the fact is that the system only makes sense as 1) vuln database; 2) in the context of responsible discosure; Responsible disclosure is from a non-AI era, where the time between a finding and a release woulds be measured in months, not weeks. Also, from a time where the probability of another human to stumble on that specific vulnerability was quite low. Pre-AI times.

    Also, in April 2025 MITRE announced that fundings to the CVE/CWE program would expire, and it took a couple of days for the Trump administration to backpedal from that. We need a global system, not an american one - and clearly, americans should not be in charge of these global programs, as there is no way to isolate the world from their local politics. Their programs, their funding, nothing against it. I just think we, collectively, should have something a bit more robust, and while at it, do it on a quite more modern basis (EU CRA is actually a good start, as it includes SBOM and mandatory reporting).

    CVE, CVSS, CPE seem all designed by comittee; CVSS and CPE are a flagrant case of that (try to apply CPE versioning to your own software, you'll get it); Its "what we have now" - there are alternatives, afaik but not that mainstream.

    by aforwardslash
  • Others have pointed out that we thought we would get security vulnerability from AI code, but it turns out AI is uncovering vulnerabilities in decades of human code.
    by xnx
  • Cool. This would be easier to interpret with a log scale. There's an option for it, but clicking it doesn't change the chart and freezes the site for me.
    by k2enemy
  • It’s impressive that the number of CVEs issued the last two years has skyrocketed, given how badly DOGE gutted the cybersecurity [0] agencies. Unfortunately we don’t know how huge the backlog may have since grown

    [0] https://www.securityweek.com/mitre-signals-potential-cve-pro...

    by danso
  • I was suspicious the absence of a severity filter was exaggerating the trend...

    But then I found this:

    https://craci.com/resources/CVE-publication-trends?sev=criti...

    Trend for critical CVEs is actually worse, at roughly 25x that of 2020, compared to all CVEs which are roughly 5x compared to 2020.

    by tomxor
  • I think a tricky thing about these metrics is GitHub and the Linux Kernel became their own CNA in mid-2024[1] and mid-2025[2]. This caused a bunch of new automation and lowered barriers to actually filing a CVE.

    As a small data point I have a >20k downloads Obsidian plugin and it got a CVE on a Beta release due to a bad pathing regex. I feel this would have never happened 2 years ago.

    So, I feel the bar for a CVE being issued is WAYYYY lower in 2025+ than before.

    [1]: http://www.kroah.com/log/blog/2024/02/13/linux-is-a-cna/

    [2]: https://github.blog/security/vulnerability-research/how-to-r...

    by philips

Explore Birbla archives