A year of open source vulnerability trends: CVEs, advisories, and malware

Reviewed advisories drop, but not for the reason you think

GitHub published 4,101 reviewed advisories in 2025—the fewest since 2021. That sounds like the open source ecosystem is getting safer, but the data tells a more nuanced story. The decline isn't because fewer vulnerabilities are being reported; it's because GitHub has largely exhausted the backlog of older, unreviewed vulnerabilities that predate the Advisory Database. Looking only at newly reported vulnerabilities from GitHub's sources, the number of reviewed advisories actually rose 19% year over year.

The "unreviewed" label in the database can also be misleading. Most advisories in that state have already been examined by a curator and found not to affect any package in a supported ecosystem, so they may never progress to a full review. The practical upshot is that developers should be seeing fewer new Dependabot alerts for old vulnerabilities.

If you encounter an unreviewed advisory that does affect a supported package, GitHub encourages you to flag it through the advisory editing process so it can be properly reviewed.

Ecosystem distribution and notable shifts in 2025

The breakdown of advisories reviewed in 2025 largely mirrors the overall database composition, with one notable outlier: Go. The ecosystem was overrepresented by 6% in this year's advisories, a result of deliberate campaigns to re-examine packages where coverage had been inconsistent and potentially missing advisories existed.

Vulnerability types and CWE tagging improvements

Cross-site scripting (CWE-79) remains the most common vulnerability type by a wide margin. But 2025 saw unusual spikes in several categories: resource exhaustion (CWE-400 and CWE-770), unsafe deserialization (CWE-502), and server-side request forgery (CWE-918). The jump in CWE-863 ("Incorrect Authorization") is largely a reclassification artifact, as the CWE program discourages the broader CWE-284 and CWE-285 categories that were previously used.

* An advisory may list more than one CWE. For example, an advisory could have both CWE-400 and CWE-770, counting toward both categories.

One of the most meaningful quality improvements was in CWE tagging specificity. Advisories with no CWE at all dropped 85%, from 452 in 2024 to just 65 in 2025. While CWE-20 ("Improper Input Validation") is still frequently cited, it's now typically accompanied by one or more additional CWEs describing the concrete failure mode, making alerts far more actionable for triage and remediation. Dependabot's auto-triage rules can be configured to filter alerts by CWE.

Prioritizing responses with CVSS and EPSS

GitHub provides two complementary scoring systems for prioritization. The Common Vulnerability Severity Score (CVSS) assesses the severity of a vulnerability's impact, while the Exploit Prediction Scoring System (EPSS) estimates the likelihood of exploitation within the next 30 days.

Most vulnerabilities skew toward the moderate-to-high end of the CVSS impact range. Low-impact vulnerabilities are likely underrepresented because researchers and maintainers often don't consider them worth the effort to report—a pattern the EPSS scores for moderate and high severity vulnerabilities tends to support.

Comparing both scoring systems against CISA's Known Exploited Vulnerabilities Catalog shows that exploited vulnerabilities are at least moderate in severity, with most falling in the critical or high range. CVSS flags more exploited vulnerabilities as critical, but it also scores plenty more non-exploited vulnerabilities at those levels. Combining both metrics provides a more reliable basis for deciding what to fix first to prevent real-world exploitation.

npm malware advisories surge

2025 was a record year for npm malware disclosures, driven largely by campaigns like SHA1-Hulud. Published malware advisories jumped 69% compared to 2024, the highest volume since GitHub first added historical malware support in 2022.

Dependabot can now alert on npm packages with known malicious versions. Once malware alerting is enabled, Dependabot matches your npm dependencies against malware advisories in the GitHub Advisory Database.

CVE publications and CNA growth

GitHub's CVE Numbering Authority (CNA) had a banner year, publishing 35% more CVE records than in 2024—outpacing the overall CVE Project's 21% increase. Growth was steady at 10–16% per quarter across the year.

The CNA program also attracted more participants, with a 20% increase in new organizations requesting CVE IDs. Unlike reviewed global advisories—which are tied to packages in supported ecosystems—any maintainer on GitHub can request a CVE, even for software published outside those ecosystems. In fact, 2025 was the first year that GitHub published more CVEs from organizations not using a supported ecosystem than from those that were.

GitHub credited 987 organizations for publishing CVEs through its CNA in 2025, highlighting the most prolific ones below.

* Organizations that published CVEs through GitHub for the first time in 2025

Looking ahead to 2026

The year's headline numbers are substantial: 4,101 reviewed advisories, 7,197 malware advisories, 2,903 CVEs published, and 679 new organizations using GitHub's CNA services.

For maintainers and organizations looking to contribute to security in the coming year, several concrete actions can help. Requesting a CVE directly from a repository security advisory is free and streamlines the publication process. Suggesting edits to unreviewed advisories or those with incorrect severity scores or affected versions improves database accuracy; in 2025, 675 community contributions refined the data. Enabling Dependabot security updates and exploring GitHub Advanced Security protects your own projects. And adding a security policy while enabling private vulnerability reporting makes it easier for researchers to report issues to you securely.