Black Duck Report Finds Open-Source Vulnerabilities per Commercial Codebase More Than Doubled

Black Duck’s 2026 Open Source Security and Risk Analysis (OSSRA) report found a sharp rise in open-source security debt across commercial software, with mean vulnerabilities per audited codebase increasing from ~280 to 581 (a 107% jump) and unique vulnerabilities averaging ~237. The report attributes the increase to expanding codebase size and dependency complexity—e.g., more files per codebase and more open-source components—while also pointing to AI coding assistants as a likely contributor to accelerated code volume growth and repeated inclusion of widely used libraries with long vulnerability histories.

Across the audited population (hundreds of codebases spanning multiple industries), the share of codebases containing at least one vulnerability remained consistently high (mid-to-high 80% range), but the absolute number of findings surged, including extreme outliers with tens of thousands of vulnerabilities in a single codebase. The report also notes that high/critical-severity issues remain common (most codebases have at least one high-risk issue; nearly half have at least one critical issue), and highlights broader ecosystem factors increasing disclosure volume (e.g., the Linux kernel becoming a CVE Numbering Authority) alongside ongoing software supply chain attack pressure, including malicious or compromised packages in major ecosystems.