How many open source vulnerabilities are there? NVD and OSV data

On 18 October 2026 the NVD API reported 409,386 CVE records in total, with 49,972 published in 2025 alone. OSV's npm feed held 230,382 records, and about 97 percent of them were malicious package reports, not CVE-style vulnerabilities. Counts describe recorded entries, not risk, so read the method notes before you cite a number.

What did we measure, and how?

We queried two public sources on 18 October 2026 and report raw counts. Nothing here is modeled or estimated.

1. NVD. The National Vulnerability Database CVE API, version 2.0, returned a total result count. For yearly figures we queried the publication date in quarterly windows, since the API limits date ranges, and summed the four quarters. We did not filter out rejected entries.
2. OSV. For each ecosystem we downloaded the public modified_id.csv file from the OSV storage bucket and counted lines, one per record. We separated records by ID prefix: GHSA for the GitHub Advisory Database, and MAL for malicious package reports.

The commands are in the last section, so you can repeat them and expect different numbers on a later day.

What does NVD show?

NVD covers software of every kind, not only open source, so it is the broad base.

Growth from 2022 to 2025 is about 1.9 times. Year over year it was roughly 17 percent, 32 percent and 23 percent. The total across all years stood at 409,386 records when we queried.

More records does not prove software got less safe. Reporting programs, the number of organizations assigning CVE IDs, scanning tools and research interest may all feed the count. Use the series to size the volume your team triages, not to judge a trend in quality.

What does OSV show?

OSV, the Open Source Vulnerabilities project, aggregates databases that publish in the OSV schema. Its documentation lists sources including the GitHub Advisory Database, the Python advisory databases, the Go vulnerability database, RustSec and OpenSSF Malicious Packages. Here are record counts per ecosystem on 18 October 2026.

The columns do not always sum to the total because other ID prefixes exist, such as PYSEC for PyPI and GO for Go. The same flaw can also appear under more than one ID, so records are not unique vulnerabilities.

What is the main finding?

For npm, malware reports dwarf vulnerability advisories. Of 230,382 records, 222,536 carry MAL IDs, about 97 percent. PyPI and RubyGems have large malicious counts too. Maven and Packagist records are almost entirely GHSA advisories.

That shifts what a dependency check must do. GitHub's advisory documentation draws the line clearly: a vulnerability is a flaw you fix by upgrading, while malware must be removed and replaced, with no fix version. A tool that only matches CVEs against versions will miss the larger share of npm records. You need malicious package feeds and install-time controls beside vulnerability matching.

What are the limits of this analysis?

Record counts depend on who reports. A small ecosystem with careful maintainers may show few records and few flaws, or few records because nobody looks. We did not weight by downloads or by exploitability. NVD figures include every kind of software. The OSV files we counted may include withdrawn records, which we did not filter. Treat all of this as a snapshot of recorded entries.

What to do

1. Size your triage by raw volume, but prioritize with exploit signals such as CISA's Known Exploited Vulnerabilities catalog, not by count.
2. Subscribe to a malicious package feed in addition to CVE data.
3. Block install-time execution paths where your builds allow it.
4. Pin and review lockfile changes.
5. Cite this page with the query date, since the numbers move daily.

How to reproduce the counts

curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1"
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1&pubStartDate=2025-01-01T00:00:00.000&pubEndDate=2025-03-31T23:59:59.999"
curl -s https://osv-vulnerabilities.storage.googleapis.com/npm/modified_id.csv | wc -l
curl -s https://osv-vulnerabilities.storage.googleapis.com/npm/modified_id.csv | grep -c ",MAL-"

Read the totalResults field in the NVD responses. Repeat the NVD query for each quarter and add the totals. Unauthenticated NVD requests are rate limited, so pause between calls.

Quick check

Sources

• NVD CVE API 2.0, queried 18 October 2026
• OSV documentation: data sources
• OSV documentation: FAQ
• GitHub Docs: About the GitHub Advisory Database
• CISA Known Exploited Vulnerabilities catalog
• OSV ecosystem feed for npm (modified_id.csv)

Last reviewed: 18 October 2026.