Software vulnerability statistics show two overlapping realities: thousands of weaknesses are documented through advisory databases, while a smaller set is actively exploited and creates immediate operational risk. In 2024, GitHub added 5,256 reviewed advisories and ended the year with 20,607 reviewed software vulnerability advisories. Google Threat Intelligence tracked 75 software and hardware zero-days exploited in the wild during the same year.
Contents
- Disclosure volume and severity
- Products exposed to zero-day exploitation
- Recurring vulnerability types
- The open-source advisory ecosystem
- Exploitation and remediation speed
- Operational risk benchmarks
Disclosure volume and severity
The GitHub Advisory Database recorded substantial growth during 2024. GitHub added 5,256 reviewed software vulnerability advisories and reported that advisory imports increased 39%. It also published more than 2,000 software vulnerability CVE records during the year. By the end of 2024, the database contained 20,607 reviewed software vulnerability advisories.
The 2024 distribution of CVEs assigned by GitHub’s Advisory Database CNA also shows why disclosure counts need context. Among those CVEs, 58% affected a supported software ecosystem and 42% did not. A database can therefore include findings with different relationships to package ecosystems, deployment environments, and dependency management.
GitHub’s later analysis of its advisory set reported that 50% of vulnerabilities were Critical or High: 15% were Critical and 35% were High. This is a severity distribution for the analyzed advisory set, reported in a 2025 article, rather than a claim about every vulnerability disclosed worldwide.
Exploit probability further narrows the population that deserves urgent attention. In the same GitHub analysis, 1,440 advisories had an Exploit Prediction Scoring System (EPSS) probability of at least 10%, equal to 7.17% of the set. Those 1,440 advisories represented 741 expected vulnerabilities attacked within the next 30 days, or 85.96% of the expected attacked vulnerabilities. EPSS is a probability estimate, so these figures describe predicted attack likelihood rather than a complete count of observed attacks.
Products exposed to zero-day exploitation
Zero-day figures measure a different part of the problem from advisory totals: exploitation in the wild before or around the time defenders can fully respond. Google Threat Intelligence’s 2024 zero-day analysis tracked 75 software and hardware zero-day vulnerabilities exploited in the wild in 2024. The comparable totals were 98 in 2023 and 63 in 2022.
Enterprise technologies became a larger share of the tracked activity. Enterprise-focused products accounted for 44% of tracked zero-days in 2024, up from 37% in 2023. Google identified 33 zero-days affecting enterprise technologies in 2024. Security and networking products accounted for 20 of those 33 enterprise zero-days, compared with 18 in 2023.
End-user platforms and products still represented the majority of tracked zero-days: 56%, or 42 vulnerabilities, in 2024. The category mix changed across several major product groups:
| Product area | Earlier period | 2024 | Measurement |
|---|---|---|---|
| Browser exploitation | 17 in 2023 | 11 | Tracked zero-days |
| Mobile-device exploitation | 17 in 2023 | 9 | Tracked zero-days |
| Desktop operating systems | 17 in 2023 | 22 | Tracked zero-days |
| Windows exploitation | 13 in 2022; 16 in 2023 | 22 | Tracked zero-days |
The Android figures also point to component risk. Google counted seven Android zero-days in 2024, and three were found in third-party components. This does not establish that third-party components are always the dominant source of mobile risk, but it does show why software inventory must include dependencies beneath the primary product name.
Vendor concentration was visible but not absolute. Google identified 18 unique enterprise vendors targeted by zero-days in 2024, compared with 22 in 2023. In its 2024 tracking, Microsoft was associated with 26 zero-days, Google with 11, Ivanti with 7, and Apple with 5. These are associations in Google’s tracking, not a ranking of overall product insecurity.
The consequences of exploitation also clustered around high-impact outcomes. Remote code execution and privilege escalation together accounted for 42 tracked zero-day exploits in 2024. Google attributed exploitation of 34 of the 75 tracked 2024 zero-days to a threat actor or actor group. Traditional espionage actors accounted for 18 of those 34 attributed zero-days, nearly 53% of attributed exploitation.
Recurring vulnerability types
The weakness category attached to an advisory helps connect statistics to engineering practice. In GitHub’s 2024 advisory data, cross-site scripting (CWE-79) was the most frequent weakness, appearing in 936 advisories. The next reported categories were exposure of sensitive information to an unauthorized actor (CWE-200), with 320 advisories, and path traversal (CWE-22), with 259.
Other frequently reported weaknesses included improper input validation (CWE-20), with 202 advisories; code injection (CWE-94), with 188; and SQL injection (CWE-89), with 181. Cross-site request forgery (CWE-352) appeared in 161 advisories, improper access control (CWE-284) in 153, uncontrolled resource consumption (CWE-400) in 149, and improper authentication (CWE-287) in 124.
| Weakness | CWE | 2024 GitHub advisories |
|---|---|---|
| Cross-site scripting | CWE-79 | 936 |
| Exposure of sensitive information | CWE-200 | 320 |
| Path traversal | CWE-22 | 259 |
| Improper input validation | CWE-20 | 202 |
| Code injection | CWE-94 | 188 |
| SQL injection | CWE-89 | 181 |
| Cross-site request forgery | CWE-352 | 161 |
| Improper access control | CWE-284 | 153 |
| Uncontrolled resource consumption | CWE-400 | 149 |
| Improper authentication | CWE-287 | 124 |
These counts are advisory occurrences in GitHub’s 2024 data. They are not prevalence rates across all software, and a single advisory may not represent the same exposure or exploitability as another advisory. Still, the ordering highlights recurring failure areas: untrusted input, browser-facing behavior, access boundaries, authentication, and resource handling.
The open-source advisory ecosystem
The database’s breadth is easier to understand by looking at its sources. In a 2025 article snapshot, GitHub’s advisory-source table listed 267,429 National Vulnerability Database advisories, of which 18,295 were reviewed. The same table listed 12,247 GitHub Repository Advisories, including 5,311 reviewed advisories.
Several ecosystem-specific sources contributed smaller but highly reviewed collections. Community Contributions supplied 4,512 advisories, including 4,160 reviewed advisories. PyPA Advisories supplied 3,040, including 2,739 reviewed. Go Vulncheck supplied 1,581, including 1,528 reviewed. NPM Advisories supplied 1,411, including 1,408 reviewed, while FriendsOfPHP supplied 1,406, including 1,396 reviewed. RustSec supplied 943 advisories, including 849 reviewed.
| Advisory source | Listed advisories | Reviewed advisories |
|---|---|---|
| National Vulnerability Database | 267,429 | 18,295 |
| GitHub Repository Advisories | 12,247 | 5,311 |
| Community Contributions | 4,512 | 4,160 |
| PyPA Advisories | 3,040 | 2,739 |
| Go Vulncheck | 1,581 | 1,528 |
| NPM Advisories | 1,411 | 1,408 |
| FriendsOfPHP | 1,406 | 1,396 |
| RustSec | 943 | 849 |
The figures describe a 2025 snapshot, not a permanent database total. They also distinguish listed advisories from reviewed advisories. That distinction matters when comparing broad intake from a general source with curated information from a language or package ecosystem.
Exploitation and remediation speed
The time between discovery, exploitation, and remediation is central to practical security. GitHub reported in Octoverse 2024 that Copilot Autofix fixed code vulnerabilities more than three times faster than manual fixing, reducing a pull-request alert from 1.5 hours to 28 minutes. GitHub reported a larger difference for specific weakness classes: cross-site scripting fixes took 22 minutes instead of almost three hours, described as seven times faster, while SQL injection fixes took 18 minutes instead of 3.7 hours, described as twelve times faster.
These are GitHub-reported remediation comparisons for Copilot Autofix, not a universal estimate for every development team. They measure a fixing workflow and should not be read as the time required to discover, validate, deploy, or confirm a production fix.
Microsoft’s November 2024 SFI update said the company had addressed 90% of high-severity cloud vulnerabilities within its reduced time-to-mitigate target by November 2024. Microsoft had published close to 800 CVEs since the beginning of 2024. Twelve of its nearly 800 CVEs in that period covered cloud-service vulnerabilities requiring no customer action. This measurement covers January through November 2024 and separates provider-side fixes from vulnerabilities that require customers to act.
Verizon’s 2025 Data Breach Investigations Report, covering incidents from November 2023 through October 2024, reported that exploitation of vulnerabilities as an initial access vector rose 34% and accounted for 20% of breaches. The report also said ransomware appeared in 44% of breaches, a 37% rise from the prior report, and that third-party involvement doubled to 30% of breaches.
Operational risk benchmarks
The CISA Known Exploited Vulnerabilities Catalog contained 1,199 entries as of August 31, 2024. A catalog entry indicates known exploitation, so this benchmark is useful for prioritization, but it is not a count of every vulnerability that exists or every vulnerability being exploited globally.
Verizon’s 2026 Data Breach Investigations Report reported that software-vulnerability exploitation began 31% of breaches in incidents from November 2024 through October 2025. The report described a 55% year-over-year increase in vulnerability exploitation as an initial access vector and reported a median of 43 days to fully resolve a critical vulnerability.
The combined picture is operationally significant. Advisory volume is broad, severity is uneven, and the exploited subset can move faster than normal patch cycles. Zero-day tracking shows exposure across enterprise, desktop, mobile, browser, security, and networking products. Weakness counts show repeated engineering patterns, while breach reports connect unremediated vulnerabilities to initial access. For teams maintaining C programs and dependencies, the most useful interpretation is to treat inventory, advisory review, exploitability signals, and fix deployment as linked measurements rather than isolated statistics.