As a small data point I have a >20k downloads Obsidian plugin and it got a CVE on a Beta release due to a bad pathing regex. I feel this would have never happened 2 years ago.
So, I feel the bar for a CVE being issued is WAYYYY lower in 2025+ than before.
[1]: http://www.kroah.com/log/blog/2024/02/13/linux-is-a-cna/
[2]: https://github.blog/security/vulnerability-research/how-to-r...
https://github.blog/security/vulnerability-research/removing...
But then I found this:
https://craci.com/resources/CVE-publication-trends?sev=criti...
Trend for critical CVEs is actually worse, at roughly 25x that of 2020, compared to all CVEs which are roughly 5x compared to 2020.
[0] https://www.securityweek.com/mitre-signals-potential-cve-pro...
Honest question: what would be the criminal purpose for that?
https://www.securityweek.com/cve-and-nvd-a-weak-and-fracture...
The irony of my vibe coded personal site going viral because the site I was using historically was down due to P2PShell...
If so, I fear you're making the opposite point, which is that AI made genuinely new discoveries that were not in its training set, about codebases that were in its training set. It quite literally expanded the horizon of what we know.
Also, the linux kernel assigns CVE for anything that can be though as a vulnerability:
> Note, due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify. This explains the seemingly large number of CVEs that are issued by the Linux kernel team
In other words, the number is fake
In other words, the method of assigning CVEs hasn't changed, but the number of CVEs has risen sharply.
I think the whole CVE/CVSS system is completely outdated, and it doesn't reflect the reality of software making for a while now (years). Also. for years, major software providers have been fighting to control their own release logs and security vulnerabilities. Recently, NIST stopped actually analyzing CVE's (one can relate to that), and the fact is that the system only makes sense as 1) vuln database; 2) in the context of responsible discosure; Responsible disclosure is from a non-AI era, where the time between a finding and a release woulds be measured in months, not weeks. Also, from a time where the probability of another human to stumble on that specific vulnerability was quite low. Pre-AI times.
Also, in April 2025 MITRE announced that fundings to the CVE/CWE program would expire, and it took a couple of days for the Trump administration to backpedal from that. We need a global system, not an american one - and clearly, americans should not be in charge of these global programs, as there is no way to isolate the world from their local politics. Their programs, their funding, nothing against it. I just think we, collectively, should have something a bit more robust, and while at it, do it on a quite more modern basis (EU CRA is actually a good start, as it includes SBOM and mandatory reporting).
CVE, CVSS, CPE seem all designed by comittee; CVSS and CPE are a flagrant case of that (try to apply CPE versioning to your own software, you'll get it); Its "what we have now" - there are alternatives, afaik but not that mainstream.
A lot of these bug reports are incorrectly filed. Let’s look at one issue, which I am sure was found with AI assistance:
CVE-2026-40719
Here’s the issue: An IP authorized to perform recursive queries can cause the DNS server to be non-responsive if it sends hundreds of specially crafted packets a minute (this can be changed to millions of packets a minute if one sets a parameter in the configuration file). Normal service is restored within a minute of the attack being stopped. The workaround would require me to essentially rewrite the recursive part of the DNS server.
Since the DNS server, like any server in a LAN, is already vulnerable to a flooding attack, this is just a flooding attack with extra steps.
I told the guy that was interesting, I’m not being paid enough to rewrite the DNS server to be immune to the attack, and people shouldn’t be using its recursion (it has very limited IPv6 support, for starters), and if they do use its recursion, only authorized IPs (e.g. 127.0.0.1 or 192.168.1.0/24) should be allowed to perform recursion.
It wasn’t a serious enough attack to merit a patch, and anyway the guy reporting the bug didn’t even have the decent courtesy to give me a patch.
The guy responded by filing for a CVE report, incorrectly calling it a “high impact” bug, and I had to make a “patch” which simply disables recursion: https://samboy.github.io/MaraDNS/patches/MaraDNS-CVE-2026-40...
Point being, a lot of these CVE reports out there which supposedly are high impact bugs are trivial things like “someone can overload a server for about one minute if they send hundreds to thousands of specially crafted DOS packets”.
(Today, I got an issue which, as far as I can tell, looks to be a Linux kernel issue and not an issue with my code. I told him to show me how he would patch my code to “fix” the issue, but so far have gotten nothing but crickets)
At this point, I'm mildly surprised when it seems like a human wrote the article.
Someone shared unslop.news and it kinda works but I forget it exists.
really disagree with western policy makers and ai company leaders on the path they are steering us, leaving us defenceless all for the sake of their obvious self serving attempts at regulatory capture.