That may just mean more software is being written and older software can still have a vulnerability that gets a CVE assigned. Also a lot of CVEs are for potenti

That may just mean more software is being written and older software can still have a vulnerability that gets a CVE assigned. Also a lot of CVEs are for potentially dangerous crashes that not necessarily can be a exploited and of course a lot of them are for client sides requiring a lot of user intervention. So no what Rapid7 is saying doesn't mean it's getting worse. Also they sell offensive penetration testing software, they have an interest in making your believe it's getting worse.