<![CDATA[Will the number of CVEs in 2031 be higher or lower than 2026?]]>Will the number of CVEs in 2031 be higher or lower than 2026?

https://www.cve.org/about/Metrics

]]>https://forum.fedi.dk/topic/abc8e1a2-9767-46d1-8eea-7a70cd11954c/will-the-number-of-cves-in-2031-be-higher-or-lower-than-2026RSS for NodeSun, 02 Aug 2026 18:55:51 GMTWed, 29 Jul 2026 13:44:19 GMT60<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:54:19 GMT]]>@evan

AI security scans are also vulnerable to prompt injection. Portswigger have some cool labs based on a vulnerable AI scanner.

]]>https://forum.fedi.dk/post/https://tooting.ch/users/spraoi/statuses/117010206504468799https://forum.fedi.dk/post/https://tooting.ch/users/spraoi/statuses/117010206504468799Thu, 30 Jul 2026 17:54:19 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:51:24 GMT]]>@luc I added a calendar reminder!

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010195023615175https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010195023615175Thu, 30 Jul 2026 17:51:24 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:50:23 GMT]]>I added a calendar event to remind myself to check.

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010191053032162https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010191053032162Thu, 30 Jul 2026 17:50:23 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:44:16 GMT]]>Anyway, my answer is: slightly lower. The backlog drains, scanning becomes an essential part of releasing software, so this huge rise flattens out and drops a bit.

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010166975370034https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010166975370034Thu, 30 Jul 2026 17:44:16 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:43:22 GMT]]>There are other factors at play, though. The fact that there are so many CVEs mean that people have needed to make filtered or curated lists. It's possible that over time those other reporting systems become more independent, eclipse the use of CVEs, and consequently people stop reporting CVEs as much. I don't think that process happens in the next 5 years, though.

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010163481720490https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010163481720490Thu, 30 Jul 2026 17:43:22 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:41:18 GMT]]>As I write this, I realize that we have already had a big change in how we make software, namely, the models themselves. I don't know how tractable an open-weight model like Gemma is to static analysis, especially for security issues. So, maybe we'll see more happening there.

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010155335270531https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010155335270531Thu, 30 Jul 2026 17:41:18 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:33:54 GMT]]>I think unless there is a big change in how we make and use software, the answer is no. Code complexity isn't an infinite resource; there is only so much interaction between components, lines of code, and external interfaces that can be tied together into an attack. As long as we make human readable, human sized code, there's a limit to how many security issues scanners can find.

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010126225751760https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010126225751760Thu, 30 Jul 2026 17:33:54 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:25:51 GMT]]>So, what about scanners getting better? We've just seen a big step up in reports mostly attributed to Fable. Won't better models find more and trickier bugs?

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010094560253514https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010094560253514Thu, 30 Jul 2026 17:25:51 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:22:58 GMT]]>I think this process will negate the problem with AI generated code. AI and human written code are both scannable.

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010083230275615https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010083230275615Thu, 30 Jul 2026 17:22:58 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:21:50 GMT]]>Doing AI security scans is automatable; I think it will become common to run in CI before releases or even on each Git commit.

As long as the same models are available to everyone, the blue team will have mostly the same tools as the red team.

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010078764665603https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010078764665603Thu, 30 Jul 2026 17:21:50 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:19:20 GMT]]>So, here's what I think: a rich vein of errors in legacy code is currently being mined by AI scanners. I think in 5 years that rich vein will be tapped out, and won't be as big of a factor.

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010068934312110https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010068934312110Thu, 30 Jul 2026 17:19:20 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:15:18 GMT]]>There are three reasons commonly cited:

- AI scanners are finding a lot of security issues
- AI code generators are making more mistakes
- New processes have made it easier to report issues

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010053122797377https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010053122797377Thu, 30 Jul 2026 17:15:18 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:14:02 GMT]]>The number per year has been overwhelming for a while; they have shot up ~2-3x over the last year or so.

https://www.cve.org/about/Metrics

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010048128602142https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010048128602142Thu, 30 Jul 2026 17:14:02 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:12:26 GMT]]>CVEs are public reports of security issues, more or less.

https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010041825194401https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010041825194401Thu, 30 Jul 2026 17:12:26 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:11:17 GMT]]>@evan Faulty question: assumes we will get to 2031.

]]>https://forum.fedi.dk/post/https://hactivedirectory.com/users/josh/statuses/117010037327401652https://forum.fedi.dk/post/https://hactivedirectory.com/users/josh/statuses/117010037327401652Thu, 30 Jul 2026 17:11:17 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 17:11:07 GMT]]>Thanks to everyone who responded. Here are my thoughts.

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010036634175947https://forum.fedi.dk/post/https://cosocial.ca/users/evan/statuses/117010036634175947Thu, 30 Jul 2026 17:11:07 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 01:43:05 GMT]]>@evan Much lower, perhaps
0.

The entire CVE system will be overwhelmed by the amount of slop generated crapware that it will collapse before 2031. In addition, AI companies will sue researchers for publishing what are perceived as "negative statements" about their software, and the resulting fear and loathing will eliminate the last remaining publication of vulnerabilities.

]]>https://forum.fedi.dk/post/https://thecanadian.social/users/Plumbert/statuses/117006387499495148https://forum.fedi.dk/post/https://thecanadian.social/users/Plumbert/statuses/117006387499495148Thu, 30 Jul 2026 01:43:05 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 01:42:12 GMT]]>@evan I think the number of vulnerabilities created by "AI" will be greater than the number of vulnerabilities found or fixed by "AI".

]]>https://forum.fedi.dk/post/https://sfba.social/users/jamesmarshall/statuses/117006383992652406https://forum.fedi.dk/post/https://sfba.social/users/jamesmarshall/statuses/117006383992652406Thu, 30 Jul 2026 01:42:12 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Thu, 30 Jul 2026 00:29:41 GMT]]>@evan will you tag us in 2031 to see if we got it right?

]]>https://forum.fedi.dk/post/https://chaos.social/users/luc/statuses/117006098837365493https://forum.fedi.dk/post/https://chaos.social/users/luc/statuses/117006098837365493Thu, 30 Jul 2026 00:29:41 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Wed, 29 Jul 2026 20:36:03 GMT]]>@evan it will be a time of great disruption, and change brings CVE's.

]]>https://forum.fedi.dk/post/https://cosocial.ca/users/johnefrancis/statuses/117005180203388520https://forum.fedi.dk/post/https://cosocial.ca/users/johnefrancis/statuses/117005180203388520Wed, 29 Jul 2026 20:36:03 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Wed, 29 Jul 2026 16:47:43 GMT]]>@evan It will be a secret because it will have been bought out by GAFAM which will sell streaming access via subscriptions to specific channels

]]>https://forum.fedi.dk/post/https://oldbytes.space/users/monnier/statuses/117004282299394937https://forum.fedi.dk/post/https://oldbytes.space/users/monnier/statuses/117004282299394937Wed, 29 Jul 2026 16:47:43 GMT<![CDATA[Reply to Will the number of CVEs in 2031 be higher or lower than 2026? on Wed, 29 Jul 2026 14:44:35 GMT]]>@evan

I think it will peak in 2027 or 2028.

]]>https://forum.fedi.dk/post/https://tooting.ch/users/spraoi/statuses/117003798175889215https://forum.fedi.dk/post/https://tooting.ch/users/spraoi/statuses/117003798175889215Wed, 29 Jul 2026 14:44:35 GMT