I think a tricky thing about these metrics is GitHub and the Linux Kernel became their own CNA in mid-2024[1] and mid-2025[2]. This caused a bunch of new automation and lowered barriers to actually filing a CVE.

As a small data point I have a >20k downloads Obsidian plugin and it got a CVE on a Beta release due to a bad pathing regex. I feel this would have never happened 2 years ago.

So, I feel the bar for a CVE being issued is WAYYYY lower in 2025+ than before.

[1]: http://www.kroah.com/log/blog/2024/02/13/linux-is-a-cna/

[2]: https://github.blog/security/vulnerability-research/how-to-r...