Here are the number of “named vulnerabilities” per year (based on data I’ve captured here). Vulnerabilities are counted for a given year based on A. what their CVE ID is, or B. If they don’t have a CVE, when the original article about that vuln was posted.
This note is deprecated. Vulns and their stats are now maintained in the Vulnerability.Garden 🪴
- 1998: 1
- 1999: 1
- 2002: 1
- 2003: 1
- 2006: 1
- 2008: 1
- 2009: 3
- 2010: 1
- 2011: 2
- 2012: 3
- 2013 1: 3
- 2014 2: 14
- 2015: 11
- 2016: 11
- 2017: 20
- 2018: 21
- 2019 3: 42
- 2020: 70
- 2021: 76
- 2022: 104
- 2023 4: 85
- 2024: 110
- 2025: 56
1 I feel most of the vulns 2013 and prior were named after-the-fact.
2 The year of Heartbleed, which is imo when this whole vuln naming madness really began.
3 2019 we start to see a big spike in folks naming their vulnerabilties.
4 2022 was a local peak for named vulns with 2022 coming back down to 2021 levels.