Open source vulnerability risk is no longer growing gradually. According to the 2026 “Open Source Security and Risk Analysis” (OSSRA) report, the mean number of vulnerabilities per codebase jumped 107% since last year’s report.
Yes, you read that correctly. The mean number of open source vulnerabilities more than doubled in a single year.
What’s driving the surge in open source vulnerabilities?
In short: increased usage of AI coding assistants. However, the doubling of mean vulnerabilities reflects multiple converging factors, including
- Component growth. With 30% more components per codebase year-over-year, the aggregate vulnerability count also increases, according to the report. Each component carries its own vulnerability history. More dependencies mean more code, and more code means more potential vulnerabilities.
- Component selection patterns. AI coding assistants tend to suggest popular, well-established libraries—the components that appear most frequently in their training data. These libraries, precisely because they’re widely used and heavily scrutinized, often have longer vulnerability histories.
- Development velocity. AI-assisted development accelerates the rate at which new dependencies enter codebases, compounding the effects noted above.
- Disclosure acceleration. The security research community’s capacity to find and disclose vulnerabilities continues to grow. Notably, the Linux Kernel team became a CVE Numbering Authority in early 2024, resulting in a dramatic increase in kernel-related CVE assignments. The vulnerability explosion is real, but its causes are multifaceted.
Software security challenges today
The report showed that 98% of codebases contain open source components, and vulnerability counts are growing faster than traditional processes can handle. To keep pace, organizations must
- Improve visibility into software components
- Prioritize vulnerabilities based on real risk
- Accelerate remediation timelines
To learn more about how open source risk is evolving and get actionable advice on how to face it, download the 2026 “Open Source Security and Risk Analysis” report.
