Open Source Vulnerability Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen, Cybersecurity | Last updated: September 4, 2026 | License: CC BY 4.0
Open source package ecosystems absorbed 10,734 reviewed security advisories in the twelve months to August 31, 2026, against 3,191 in the twelve months before that. That is 3.36 times the volume in a single year. Nearly half were rated critical or high, and 1,273 of them never received a CVE identifier at all.
Quick Answer
According to Axis Intelligence Research, the GitHub Advisory Database recorded 10,734 reviewed open source package advisories between September 1, 2025 and August 31, 2026, up 236.4% year over year, with 48.9% rated critical or high. 11.9% carry no CVE identifier, so a scanner keyed to CVE alone misses roughly one advisory in eight. Of the 1,694 entries in the CISA Known Exploited Vulnerabilities catalog, 131 (7.7%) map to an open source package advisory, and the Axis Open Source Ecosystem Pressure Index (OSEPI) places npm highest at 70.0 on a 0-to-100 scale.
Key Findings
- According to Axis Intelligence Research, reviewed open source advisory volume reached 10,734 in the twelve months to August 31, 2026, against 3,191 in the prior twelve months, a 236.4% increase, per the GitHub Advisory Database snapshot taken September 4, 2026.
- According to Axis Intelligence Research, 1,273 of those 10,734 advisories (11.9%) carry no CVE alias, meaning CVE-keyed vulnerability management misses them entirely unless it also ingests ecosystem-native advisory feeds.
- According to Axis Intelligence Research, 131 of the 1,694 entries (7.7%) in CISA’s Known Exploited Vulnerabilities catalog resolve to an open source package advisory, and that share rose to 11.9% among 2026 additions (25 of 210).
- According to Axis Intelligence Research, 10 of the 25 open source KEV entries added in 2026 (40.0%) are AI or ML packages — Langflow, LiteLLM, MLflow, Ray, and Marimo — against 3 of 106 (2.8%) in all prior years combined.
- According to Axis Intelligence Research, the Open Source Ecosystem Pressure Index (OSEPI) reads npm 70.0, PyPI 59.2, Go 55.8, NuGet 51.1, Maven 48.3, Packagist 47.2, crates.io 46.9, RubyGems 33.8 as of September 4, 2026.
How Many Open Source Vulnerabilities Were Disclosed in the Past Year?
The number that matters is not the CVE count. It is the count of advisories that actually name a package and a fixed version, because that is the unit a dependency scanner can act on.
Working from a full local clone of the GitHub Advisory Database, Axis Intelligence Research counted every non-withdrawn, human-reviewed advisory published between September 1, 2025 and August 31, 2026. The result is 10,734. The same window one year earlier produced 3,191.
Reviewed open source advisories by month
| Month | Advisories | Source |
|---|---|---|
| September 2025 | 350 | GitHub Advisory Database |
| October 2025 | 374 | GitHub Advisory Database |
| November 2025 | 248 | GitHub Advisory Database |
| December 2025 | 369 | GitHub Advisory Database |
| January 2026 | 482 | GitHub Advisory Database |
| February 2026 | 754 | GitHub Advisory Database |
| March 2026 | 1,564 | GitHub Advisory Database |
| April 2026 | 1,498 | GitHub Advisory Database |
| May 2026 | 1,661 | GitHub Advisory Database |
| June 2026 | 1,442 | GitHub Advisory Database |
| July 2026 | 1,304 | GitHub Advisory Database |
| August 2026 | 688 | GitHub Advisory Database |
Snapshot date September 4, 2026. August is partially subject to review lag and will rise.
The break is in March 2026. Volume roughly doubled from February and has not returned. One obvious question is whether this is a backfill of old vulnerabilities rather than new disclosure. It is not: 8,005 of the 9,393 advisories published January through August 2026 carry a 2026 CVE identifier, and a further 1,150 carry no CVE at all. Fewer than 4% reach back to a pre-2026 identifier.
A second question is concentration. One npm package, openclaw, accounts for 590 advisories inside the window on its own. Strip it out and the twelve-month total is 10,144, still 3.18 times the prior year. The surge does not depend on any single project.
Marcus Chen, Cybersecurity: Three and a third times the advisory volume in one year is not attackers getting three times busier. It is discovery capacity getting cheaper, and the timing points at automated analysis reaching the long tail of packages that no human researcher was ever going to audit. That is good news the way a colonoscopy is good news. The bugs were already in your dependency tree; what changed is that somebody finally looked. The operational consequence is unglamorous and immediate: a triage queue sized for the 369 advisories of December 2025 met 1,661 in May 2026, and no security team got a matching headcount increase in between. Prioritisation stops being a maturity goal and becomes the only way the queue clears.
Source: Axis Intelligence Research — CC BY 4.0
Which Package Ecosystems Carry the Most Risk?
Raw advisory counts favour whichever ecosystem has the most packages. Pressure is a different question: volume, severity, blind spots, and confirmed exploitation, together.
The Open Source Ecosystem Pressure Index (OSEPI)
Full name: Open Source Ecosystem Pressure Index. What it measures: the combined vulnerability-management burden a single package ecosystem places on a team consuming it, on a 0-to-100 scale where 100 is the worst observed value for each component.
Components and weights:
- Advisory volume, 35% — reviewed advisories published in the trailing twelve months.
- Severity load, 25% — share of those advisories rated critical or high.
- Coverage gap, 20% — share of those advisories carrying no CVE identifier, which is the portion invisible to CVE-keyed tooling.
- Exploitation density, 20% — all-time CISA KEV-confirmed advisories per 1,000 advisories in that ecosystem.
Formula: each component is max-scaled across the eight ecosystems (component value ÷ highest observed value × 100), then combined at the weights above. Baseline snapshot September 4, 2026.
Worked example, npm: volume 2,925 ÷ 2,925 × 100 × 0.35 = 35.0. Severity 52.3 ÷ 52.4 × 100 × 0.25 = 24.93. Coverage gap 15.0 ÷ 39.8 × 100 × 0.20 = 7.57. Exploitation density 1.87 ÷ 15.0 × 100 × 0.20 = 2.49. Total = 70.0.
| Ecosystem | Advisories (12m) | YoY change | Critical or high | No CVE ID | KEV per 1,000 | OSEPI | Source |
|---|---|---|---|---|---|---|---|
| npm | 2,925 | +522.3% | 52.3% | 15.0% | 1.87 | 70.0 | Axis calculation from GitHub Advisory Database + CISA KEV |
| PyPI | 2,087 | +227.1% | 52.4% | 9.4% | 3.35 | 59.2 | Axis calculation from GitHub Advisory Database + CISA KEV |
| Go | 2,051 | +249.4% | 50.5% | 9.6% | 1.75 | 55.8 | Axis calculation from GitHub Advisory Database + CISA KEV |
| NuGet | 355 | +290.1% | 35.8% | 19.4% | 15.0 | 51.1 | Axis calculation from GitHub Advisory Database + CISA KEV |
| Maven | 1,134 | +97.2% | 47.8% | 3.4% | 7.63 | 48.3 | Axis calculation from GitHub Advisory Database + CISA KEV |
| Packagist | 1,483 | +153.1% | 42.2% | 8.4% | 3.79 | 47.2 | Axis calculation from GitHub Advisory Database + CISA KEV |
| crates.io | 483 | +161.1% | 42.4% | 39.8% | 0.69 | 46.9 | Axis calculation from GitHub Advisory Database + CISA KEV |
| RubyGems | 193 | +135.4% | 42.5% | 12.4% | 3.7 | 33.8 | Axis calculation from GitHub Advisory Database + CISA KEV |
Three readings are worth pulling out of that table.
npm’s 522.3% year-over-year jump is the openclaw effect plus a real underlying climb; excluding that one package the ecosystem still grew 396.8%, from 470 advisories to 2,335. crates.io scores 46.9 on comparatively modest volume because 39.8% of its advisories never get a CVE — the RustSec advisory pipeline publishes without one routinely, which is fine for cargo audit users and invisible to everyone else. And NuGet, the smallest ecosystem in the table by advisory count, carries by far the highest exploitation density at 15.0 KEV-confirmed advisories per 1,000, because .NET advisories skew toward enterprise-facing server products rather than transitive utility libraries.
Maven is the counter-case. Its advisory growth is the slowest in the table at 97.2% and its coverage gap the smallest at 3.4%, which reflects a mature ecosystem where CVE assignment is routine. It still carries 53 KEV-confirmed advisories all-time, more than any other ecosystem.
Marcus Chen, Cybersecurity: The coverage-gap column is the one to take to a budget meeting. If your scanner correlates on CVE identifiers, 39.8% of Rust advisories and 19.4% of NuGet advisories simply are not in your data. Not deprioritised, not low severity — absent. That is not a tuning problem, it is a feed problem, and the fix is ingesting ecosystem-native advisory sources alongside the CVE stream. Also note what the exploitation-density column is not saying: npm has the lowest KEV density in the table at 1.87 per 1,000. Enormous volume, comparatively little confirmed exploitation. Volume and exploitation are separate axes, and treating advisory count as a threat proxy is how teams end up patching a thousand transitive dev-dependencies while an ActiveMQ instance sits exposed.
How Many Open Source Vulnerabilities Are Actually Being Exploited?
CISA’s Known Exploited Vulnerabilities catalog is the only widely accepted public list of vulnerabilities with confirmed in-the-wild exploitation, which makes it the right denominator for this question. Axis Intelligence Research pulled catalog version 2026.09.02 from CISA’s own kev-data repository, 1,694 entries, and matched every CVE identifier against the aliases in the advisory corpus.
131 entries matched — 7.7% of the catalog. That is the answer to the question most vendor material dodges: confirmed exploitation of open source packages, as distinct from open source products like Apache HTTP Server or Linux, is a minority of the exploitation record.
Open source KEV entries by year added
| Year added | KEV entries | Open source package entries | Share | Source |
|---|---|---|---|---|
| 2021 | 311 | 23 | 7.4% | Axis calculation from CISA KEV + GitHub Advisory Database |
| 2022 | 555 | 40 | 7.2% | Axis calculation from CISA KEV + GitHub Advisory Database |
| 2023 | 187 | 16 | 8.6% | Axis calculation from CISA KEV + GitHub Advisory Database |
| 2024 | 186 | 8 | 4.3% | Axis calculation from CISA KEV + GitHub Advisory Database |
| 2025 | 245 | 19 | 7.8% | Axis calculation from CISA KEV + GitHub Advisory Database |
| 2026 (to Sept 2) | 210 | 25 | 11.9% | Axis calculation from CISA KEV + GitHub Advisory Database |
2026 is the first year the open source package share has cleared 10%.
There is a useful counterweight in the same data. Of the 131 open source KEV entries, 15 (11.5%) are flagged by CISA as used in known ransomware campaigns, against 352 of 1,694 (20.8%) across the full catalog. Open source package vulnerabilities are confirmed exploited less often than the catalog average and ransomware-associated at roughly half the catalog rate. Whatever the supply-chain narrative says, ransomware crews are still overwhelmingly entering through edge devices and enterprise appliances, a pattern our credential attack statistics analysis traces from the identity side.
Why Are AI and ML Packages Suddenly in the Exploitation Data?
This is the finding that did not exist twelve months ago.
Axis Intelligence Research classified every open source KEV entry against a disclosed list of AI and ML package names (published in full in the dataset). Of the 25 open source entries CISA added in 2026, 10 are AI or ML packages. Across every prior year combined — 106 entries from 2021 through 2025 — the count is 3, and two of those are Apache Airflow flaws carrying 2020 CVE identifiers that predate the current wave.
AI and ML packages added to CISA KEV in 2026
| CVE | Project | Package ecosystem | Date added | Source |
|---|---|---|---|---|
| CVE-2026-33017 | Langflow | PyPI | 2026-03-25 | CISA KEV |
| CVE-2026-39987 | Marimo | PyPI | 2026-04-23 | CISA KEV |
| CVE-2026-42208 | LiteLLM | PyPI | 2026-05-08 | CISA KEV |
| CVE-2025-34291 | Langflow | PyPI | 2026-05-21 | CISA KEV |
| CVE-2026-42271 | LiteLLM | PyPI | 2026-06-08 | CISA KEV |
| CVE-2026-55255 | Langflow | PyPI | 2026-07-07 | CISA KEV |
| CVE-2026-0770 | Langflow | PyPI | 2026-07-21 | CISA KEV |
| CVE-2025-62593 | Ray | PyPI | 2026-08-17 | CISA KEV |
| CVE-2026-64849 | MLflow | PyPI | 2026-08-19 | CISA KEV |
| CVE-2026-59822 | LiteLLM | PyPI | 2026-09-02 | CISA KEV |
Every one is a PyPI package. Four are Langflow, three are LiteLLM.
The advisory data underneath tells the same story earlier. Applying the same package list to the full advisory corpus, AI and ML packages accounted for 516 advisories in the trailing twelve months against 226 the year before, a 128.3% increase, and 61.6% of them were rated critical or high against 48.9% across all advisories. The most-advised packages are Open WebUI (126), Flowise (96), Apache Airflow (44), vLLM (36), MLflow (30), and Langflow (26).
Marcus Chen, Cybersecurity: Look at what those projects have in common. They are orchestration surfaces — web consoles, model gateways, workflow builders — that were written to be run on a trusted laptop and are now deployed on infrastructure with cloud credentials attached. The attack pattern in the KEV entries is not exotic model manipulation. It is unauthenticated endpoints, template injection, and code execution through features that were never meant to face a network. The uncomfortable part for anyone tracking this alongside our AI cyberattack statistics: the same tooling wave produced both the surge in discovery and the surge in exposed surface. Three-quarters of the 2026 open source KEV additions being AI infrastructure is not a coincidence of the calendar. It is what happens when a category goes from research code to production dependency in about eighteen months without an intervening security review.
Which Weakness Types Dominate Open Source Advisories?
| CWE | Weakness | Advisories (12m) | Source |
|---|---|---|---|
| CWE-79 | Cross-site scripting | 904 | GitHub Advisory Database |
| CWE-22 | Path traversal | 785 | GitHub Advisory Database |
| CWE-863 | Incorrect authorization | 630 | GitHub Advisory Database |
| CWE-918 | Server-side request forgery | 592 | GitHub Advisory Database |
| CWE-862 | Missing authorization | 489 | GitHub Advisory Database |
| CWE-400 | Uncontrolled resource consumption | 453 | GitHub Advisory Database |
| CWE-770 | Allocation without limits | 442 | GitHub Advisory Database |
| CWE-200 | Information exposure | 426 | GitHub Advisory Database |
Authorization failures are the story here. CWE-863 and CWE-862 together account for 1,119 advisories, more than cross-site scripting, and they are the two classes that static analysis handles worst because correctness depends on application intent rather than pattern. SSRF at 592 is the other number worth watching: it is the weakness class most directly implicated in cloud metadata theft, and it maps closely onto the AI orchestration tools above, which fetch remote resources as a core function.
Severity distribution, twelve months to August 31, 2026
| Severity | Advisories | Share | Source |
|---|---|---|---|
| Critical | 1,152 | 10.7% | GitHub Advisory Database |
| High | 4,095 | 38.2% | GitHub Advisory Database |
| Moderate | 4,493 | 41.9% | GitHub Advisory Database |
| Low | 994 | 9.3% | GitHub Advisory Database |
What Changes for Open Source Maintainers on September 11, 2026?
Seven days after this analysis publishes, the first hard deadline of the EU Cyber Resilience Act arrives.
The European Commission’s summary of Regulation (EU) 2024/2847 is unambiguous on timing: the CRA entered into force on December 10, 2024, becomes fully applicable on December 11, 2027, and the reporting obligations in Article 14 apply from September 11, 2026. Notification deadlines are 24 hours for an early warning, 72 hours for the main notification, and 14 days after a mitigation is available for the final report on an actively exploited vulnerability.
Article 24 creates a category the CRA invented: the open-source software steward, defined as a legal person other than a manufacturer that systematically supports the development of open source software intended for commercial activities and ensures its viability. Stewards must maintain a documented cybersecurity policy, cooperate with market surveillance authorities, and report actively exploited vulnerabilities to the extent they are involved in developing the product. The Commission also states plainly that open-source software stewards are not subject to penalties for CRA infringements.
Read against the exploitation data above, the practical scope is narrow and specific. Twenty-five open source package vulnerabilities entered the confirmed-exploitation record in the first eight months of 2026. Those, and vulnerabilities like them, are the reporting trigger — not the 10,734 advisories, and not the moderate-severity majority.
For teams tracking the downstream side of this, the same set of numbers feeds our KEV tracker, the zero-day tracker for pre-patch exploitation, patch management statistics for remediation timelines, vulnerability exploitation statistics for the full exploitation picture, CVE statistics for the identifier-level view, and the cybersecurity statistics pillar for breach cost context.
Methodology
Collection. Two primary datasets were retrieved and processed locally on September 4, 2026. The first is the complete GitHub Advisory Database, cloned from its public repository; analysis is restricted to the 34,180 non-withdrawn, human-reviewed advisories in the github-reviewed set, which are the advisories tied to a named package in a named ecosystem. Machine-generated unreviewed advisories are excluded throughout. The second is CISA’s Known Exploited Vulnerabilities catalog, version 2026.09.02, released September 2, 2026, containing 1,694 entries, retrieved from CISA’s own distribution repository. Corpus scale context comes from the NIST National Vulnerability Database API, which reported 385,847 CVE records at a query timestamp of September 3, 2026.
Windows. The trailing twelve-month window is September 1, 2025 through August 31, 2026. The comparison window is September 1, 2024 through August 31, 2025. Both use the advisory published field. August 2026 counts are subject to review lag and will rise on later snapshots.
Ecosystem attribution. An advisory counts once per distinct ecosystem it affects, not once per affected package. An advisory affecting twenty Maven artifacts counts once for Maven; an advisory affecting both Go and GitHub Actions counts once for each. Ecosystems with fewer than 150 trailing-twelve-month advisories are excluded from OSEPI.
KEV matching. A KEV entry is classified as open source when its CVE identifier appears as an alias on at least one reviewed package advisory. This deliberately excludes open source products distributed outside package registries, so the resulting share is a floor, not a ceiling.
AI and ML classification. Package names were matched against a fixed list of 75 AI and ML package identifiers, published in full in the accompanying dataset so any reader can reproduce or dispute the classification. Matching is on exact package name after normalisation, not on keyword substrings.
OSEPI construction. Weights are 35% volume, 25% severity load, 20% coverage gap, 20% exploitation density. Volume carries the largest weight because triage capacity is consumed per advisory regardless of severity. Exploitation density uses the all-time KEV ratio rather than a twelve-month figure because annual KEV additions per ecosystem are too small for a stable rate. Max-scaling is used rather than a fixed denominator so the index is interpretable as relative pressure across the eight ecosystems in a given snapshot; comparisons across snapshots require the scaling maxima, which are published in the dataset.
A calculation we declined to publish. An obvious next step is to divide open source KEV entries by open source advisory volume to produce an “exploitation probability per advisory.” Axis Intelligence Research does not publish that ratio and has recorded the refusal in the dataset. KEV additions are drawn from CISA’s evidence of exploitation against United States federal attack surface, while the advisory corpus is global and dominated by transitive libraries that federal agencies may never deploy. The numerator and the denominator describe different populations, and the resulting percentage would look like a probability while measuring nothing.
Arithmetic. Every derived figure was computed in Python from the raw datasets and re-verified in a second pass against the published prose.
About This Dataset
File: open-source-vulnerability-statistics-2026.csv — 96 rows, 14 columns, UTF-8, comma-separated.
Columns: metric, value, unit, as_of_date, geography, segment, source_org, source_document, source_url, retrieved_date, is_primary, axis_calculated, method_note, data_type.
Coverage: open source package advisory volume, severity, weakness class, CVE coverage, and confirmed-exploitation figures by ecosystem and by AI/ML segment, September 2024 through September 2026, global.
License: Creative Commons Attribution 4.0 International (CC BY 4.0). Free to reuse, republish, and redistribute with attribution.
Citation line: Axis Intelligence Research, Open Source Vulnerability Statistics 2026.
How to Cite This Research
APA: Axis Intelligence Research. (2026). Open source vulnerability statistics 2026: Advisory volume, ecosystem exposure, and confirmed exploitation. https://axis-intelligence.com/open-source-vulnerability-statistics/
MLA: Axis Intelligence Research. “Open Source Vulnerability Statistics 2026: Advisory Volume, Ecosystem Exposure, and Confirmed Exploitation.” Axis Intelligence, 4 Sept. 2026, axis-intelligence.com/open-source-vulnerability-statistics/.
Chicago: Axis Intelligence Research. “Open Source Vulnerability Statistics 2026: Advisory Volume, Ecosystem Exposure, and Confirmed Exploitation.” Axis Intelligence, September 4, 2026. https://axis-intelligence.com/open-source-vulnerability-statistics/.
Frequently Asked Questions
If an advisory has no CVE, will my SCA scanner catch it?
Only if it ingests ecosystem-native advisory feeds rather than correlating purely on CVE identifiers. In the twelve months to August 31, 2026, 1,273 of 10,734 reviewed open source advisories (11.9%) had no CVE alias. The gap is not evenly distributed: it reaches 39.8% in crates.io and 19.4% in NuGet, against 3.4% in Maven. Check which feeds your scanner consumes before assuming coverage.
Which ecosystem should I prioritise if I can only fix one dependency tree this quarter?
By OSEPI, npm at 70.0 carries the highest combined pressure, driven almost entirely by volume — 2,925 advisories in twelve months and 52.3% of them critical or high. But if your criterion is confirmed exploitation rather than queue burden, the answer inverts: NuGet carries 15.0 KEV-confirmed advisories per 1,000 and npm carries 1.87. Pick the axis that matches your actual threat model before picking the ecosystem.
Does the advisory surge mean open source got less secure this year?
No, and the distinction matters for how you resource triage. 8,005 of the 9,393 advisories published January through August 2026 carry a 2026 CVE identifier, so this is current disclosure rather than historical backfill — but disclosure volume measures how hard people are looking, not how many flaws exist. The vulnerabilities being found in March 2026 were in those packages in March 2025. What changed is discovery throughput.
Are AI and ML libraries actually being attacked, or is that vendor marketing?
They are in CISA’s confirmed-exploitation catalog, which requires evidence rather than plausibility. Ten of the 25 open source package vulnerabilities CISA added in 2026 are AI or ML packages, including four Langflow and three LiteLLM entries, against three in all prior years combined. All ten are PyPI packages.
How much of the ransomware problem comes from open source dependencies?
Less than the supply-chain discourse implies. Of the 131 open source package entries in the KEV catalog, 15 (11.5%) carry CISA’s known-ransomware-campaign flag, against 352 of 1,694 (20.8%) across the whole catalog. Open source package flaws are under-represented in ransomware exploitation relative to the catalog average.
Does the EU Cyber Resilience Act make me liable for vulnerabilities in my dependencies?
If you place a product on the EU market under your own name, you are the manufacturer and Article 14 reporting obligations apply to actively exploited vulnerabilities in that product from September 11, 2026, including components you did not write. Open-source software stewards — legal entities that systematically sustain projects intended for commercial use — carry a lighter Article 24 obligation set and, per the European Commission, are not subject to penalties for CRA infringements. Individual maintainers publishing outside commercial activity are outside manufacturer obligations entirely.
Is cross-site scripting still the top open source weakness class?
By single CWE, yes: CWE-79 leads at 904 advisories in the trailing twelve months. But authorization failures beat it in aggregate — CWE-863 (incorrect authorization, 630) plus CWE-862 (missing authorization, 489) total 1,119. That class is harder to catch in code review because correctness depends on what the application intends, not on what the code pattern looks like.
What does OSEPI measure that a simple CVE count does not?
Four things at once: how many advisories an ecosystem generates, how severe they are, what proportion is invisible to CVE-keyed tooling, and how often that ecosystem’s flaws show up in confirmed exploitation. A CVE count answers only the first, and by construction cannot see the 11.9% of advisories that have no CVE.
Can I reuse this dataset?
Yes, under CC BY 4.0. Cite as: Axis Intelligence Research, Open Source Vulnerability Statistics 2026, axis-intelligence.com. The underlying GitHub Advisory Database is itself CC BY 4.0 and the CISA KEV catalog is United States government public-domain data; both are credited row by row in the CSV.
Related Axis Intelligence Research datasets: digital identity fraud statistics · credential attack statistics · AI scam statistics · online fraud statistics · social engineering statistics · AI in banking statistics · Insider Threat Statistics · Deepfake Fraud Statistics