Vulnerability Trends: Measuring Progress

We analyzed data from the National Vulnerability Database (NVD). Designed and operated by the National Institute of Standards and Technology (NIST) with support from the Department of Homeland Security, the NVD provides fine-grained search capabilities of all publicly reported software vulnerabilities since 1997-a total of 41,810 vulnerabilities for more than 20,000 products. Frequently, a single vulnerability can affect a large number of products-for example, when the fault occurs in a library function.