Vulnerabilities Surge, But Messy Reporting Blurs Picture

Vulnerabilities surged again in 2025, with 48,177 CVEs assigned, data analysed from the National Vulnerability Database shows, making it the ninth consecutive year of record vulnerability reporting according to Robert Lemos. MITRE is no longer the top issuer, having dropped to fourth place for the first time, while three WordPress-related CNAs — Patchstack, Wordfence, and WPScan — together account for about 23% of all identified CVEs that year.

Patchstack alone submitted more than 7,000 issues in 2025, and VulDB and the Linux Kernel CNA also featured prominently with 5,900 and 5,679 CVEs respectively; the Linux kernel team has emphasised a conservative approach since becoming a CNA in February 2024.

The article notes that the rise in CVEs reflects a healthier reporting ecosystem rather than a spike in risk, with ongoing data-quality challenges such as around 90% of CVEs in 2025 having a CVSS score and less than 60% having a CPE entry, according to Gamblin’s analysis. It also highlights that duplication and “CVE farming”—a result of automation and large-language-model review—mean counting can vary, but the trend points to improved disclosure and coordination across a federated CVE programme. According to Gamblin’s analysis, the CVE ecosystem remains strong even as the numbers grow.