Industry Vulnerability Disclosure Trends

First, let's look at the vulnerability disclosures in each year since the NVD was started in 1999. It is interesting to note that I can find vulnerabilities with publication dates going back to January of 1989 (CVE-1999-1471) in the NVD. Vulnerabilities published prior to 1999 appear to have been assigned CVE IDs starting with “1999” because that’s when the first CVE list was collected and published. I found this explanation in an article published by Tripwire.

“The very first CVE List contained 321 vulnerabilities, chosen after careful deliberation and consideration of duplicates. In September 1999, the first CVE List was made public… In the summer of 2000, MITRE put out a request for legacy vulnerability information with the intent of adding it to the CVE List. This would create a more complete list of known vulnerabilities, especially prior to the inception of the List. MITRE received more than 8,400...