CodeScoring: Critical Open-Source Flaws Up 4.9x in 2026

In Go, critical vulnerabilities grew 5.1 times, from 78 to 396. They touch 12,443 stable module versions versus 5,995 before, a 2.1-fold rise.

More than two thirds of this year's critical vulnerabilities are rated in CVSS as exploitable over the network without prior privileges or user interaction. In that scenario attackers do not need to steal employee credentials or trick anyone into opening a malicious file: the network-facing software itself is the target.

Automation and AI behind the surge

Vulnerability databases keep filling up. Between 15 September and 15 October 2026 alone, 4,609 new unique vulnerabilities of all severity levels were published in open components.

CodeScoring experts link the growth mainly to more intensive bug hunting and broader reporting. Researchers increasingly use automated analysis and AI-based tools, and more developers systematically disclose the defects they find. Modern audit methods also uncover errors in long-used code, so advisories can appear for libraries that companies adopted years ago and never updated.

Artem Maksimov, product analyst at CodeScoring, says organizations must regularly check the makeup of their software and track new vulnerability data. In his words, known threats should be monitored not only at the level of finished vendor products but also at the level of the components inside them, with priority given to problems affecting live external services that directly threaten business continuity.

Software composition analysis supports this approach by automatically tracking application contents, detecting vulnerable dependencies and identifying component versions in which the problems have been fixed.