The CVE Tracker is a data visualization tool that tracks the number of Common Vulnerabilities and Exposures (CVEs) issued per month since 1999. CVEs are standardized identifiers for publicly disclosed cybersecurity vulnerabilities in software and hardware. The tracker provides various views, including cumulative counts, daily trends, and specific filters for 'NSA 0-Days' and 'Shigure' models. By plotting these numbers over decades, the tool highlights a notable acceleration in the frequency of vulnerability disclosures in recent years.
The tracker provides various views, including cumulative counts and daily trends, to highlight the acceleration of vulnerability disclosures.
Discussion surrounding the tracker suggests that the recent surge in CVE numbers may be influenced by several factors beyond just an increase in actual security flaws. One prominent theory is that artificial intelligence is being used to uncover vulnerabilities in decades of existing human-written code, rather than just creating new ones. Others point to 'Goodhart's Law'—where a measure becomes a target—suggesting that the sheer volume of CVEs might reflect a change in reporting behavior. For example, some organizations may open CVEs to force software upgrades when standard requests are denied. Additionally, some projects, like the Linux kernel, have a reputation for being overly cautious, assigning CVEs to almost any bug fix that could theoretically be exploited, which may inflate the total count.
Technical limitations and data nuances also complicate the interpretation of the trend. Commenters noted that 'critical' severity CVEs may be growing at a much faster rate than the general population of vulnerabilities. There are also concerns regarding the consistency of the data; some users reported discrepancies between the site's displayed numbers and the raw JSON files, and others noted that the site's logarithmic scale toggle occasionally fails to render correctly. Furthermore, some argue that the current CVE/CVSS system is outdated for the modern era of rapid, AI-influenced software development, where the time between discovery and disclosure has shrunk significantly. These factors suggest that while the tracker provides a clear visual of a growing trend, the underlying reasons for that growth are a mix of technological advancement, reporting policy, and systemic classification choices.