Welcome to the Vulnpocalypse. This is the counter I keep running in the corner of the screen so I can watch the CVE pipeline lap every year that came before it. Every chart here is one more angle on the same story: how fast CVEs are being published, and how far ahead of the years before it the current pace is running. Data is from the Vulners CVE archive. Grab a coffee before you scroll.
Five years, five lines, one very rude red one. The newest year crosses the full-year totals of earlier years long before its own twelve months are up, then keeps climbing like the finish line owed it money. Numbers that took those years a whole year to reach, it reaches with months to spare. The gap between the red line and the pack is not a rendering glitch. That is just the tide coming in.#This is the speedometer, and the needle is pinned. The current year sits well above the prior year's line and stays there. The two lines shook hands once, early on, and have not spoken since.#The lines above tell you how fast; this one tells you who. The same firehose, sliced by month and split by CNA, so you can watch the ribbons swell. Each column is a month; the taller it stacks, the more CVEs that month shipped. Trace any single CNA's band across the months to see how its output rises and falls. This is what "more of everything, from everyone" looks like when you actually draw it.#Down from the whole year to a single window. Three snapshots of the exact same slice of the calendar, lined up side by side: this month so far in the middle, the same days of last month on the left, and the same stretch a year ago on the right. Same window, three different levels of pain. It answers two questions at a glance, whether the current month is already outrunning the one before it, and how much further ahead of last year the whole pipeline has drifted. The current column is rarely the short one.#Two ways to guess where this ends, and neither one lets you sleep. One line runs the current rate forward; the other draws the rounder baseline. Both land well above where the prior year finished, which already reads like the good old days. The asterisks mean projection. The slope means call the cavalry.#And here is the part nobody counts. These are CVE IDs already reserved but not yet published — the queue behind the curtain, the storm still out at sea, none of it counted in the numbers above. Each row is a source feeding that backlog; each column is a month; the brighter the cell, the more reserved CVEs that source touched. Read a column to see who's driving the month, and watch the rows: a band that sits dark and then suddenly lights up is a new source arriving — the next wave forming before it breaks. Whatever the rest of this page frightened you with, it hasn't counted these yet.#
