CVE Tracker surfaces on Hacker News with no comments yet
A Hacker News submission links to CVE Tracker, a site hosted at cve.0xosprey.com, posted by user Group_B and drawing 9 points within its first hour. The linked page itself could not be fetched, so only the submission listing is available; the thread had no comments at the time of capture, leaving the tool's features and purpose undocumented.
Consider applying for YC's Winter 2027 batch! Applications are open till November 2.
- philips
I think a tricky thing about these metrics is GitHub and the Linux Kernel became their own CNA in mid-2024[1] and mid-2025[2]. This caused a bunch of new automation and lowered barriers to actually filing a CVE.
As a small data point I have a >20k downloads Obsidian plugin and it got a CVE on a Beta release due to a bad pathing regex. I feel this would have never happened 2 years ago.
So, I feel the bar for a CVE being issued is WAYYYY lower in 2025+ than before.
[1]: http://www.kroah.com/log/blog/2024/02/13/linux-is-a-cna/
[2]: https://github.blog/security/vulnerability-research/how-to-r...
- tomxor
I was suspicious the absence of a severity filter was exaggerating the trend...
But then I found this:
https://craci.com/resources/CVE-publication-trends?sev=criti...
Trend for critical CVEs is actually worse, at roughly 25x that of 2020, compared to all CVEs which are roughly 5x compared to 2020.
- danso
It’s impressive that the number of CVEs issued the last two years has skyrocketed, given how badly DOGE gutted the cybersecurity [0] agencies. Unfortunately we don’t know how huge the backlog may have since grown
[0] https://www.securityweek.com/mitre-signals-potential-cve-pro...
- k2enemy
Cool. This would be easier to interpret with a log scale. There's an option for it, but clicking it doesn't change the chart and freezes the site for me.
- xnx
Others have pointed out that we thought we would get security vulnerability from AI code, but it turns out AI is uncovering vulnerabilities in decades of human code.