I was suspicious the absence of a severity filter was exaggerating the trend...
But then I found this:
https://craci.com/resources/CVE-publication-trends?sev=criti...
Trend for critical CVEs is actually worse, at roughly 25x that of 2020, compared to all CVEs which are roughly 5x compared to 2020.
Severities are not directly comparable. The CVSS docs leave the choice of the "vulnerable component" as an exercise for the reader. The choice of the "vulnerable component" is also not encoded in the score so a critical may be a critical in the context of a library scored against a theoretical (and bad) program or it could be scored on a single website with known mitigations.
Thanks for the link! 1) It seems some are coming down, like RedHat 2) This pattern should be expected based on the amount of "intelligent" compute, heuristic agentic algorithms, money and awareness on the issue of software vulnerabilities at the moment. Projects like Glasswing, Daybreak, Fairwind, Purple etc are in full swing and seemingly effective
They are also incentivized to find high severity vulnerabilities - and/or to announce found vulnerabilities as high severity.
After all, what would all that hardware and research be worth it, if it didn't find the most critical vulnerabilities around?
Many CVEs have too high severity for what they describe.
I'll look to add some additional features to the site based on this feedback - thanks!