A 2019 Synopsys reports 96% of code bases they scanned included open source software, and up to 60% contain a known vulnerability. Automated tools like fuzzing are getting better and better at finding new bugs and vulnerabilities. But automated vulnerability discovery tools dont work well with current manual process to triage and index vulnerabilities. Hundreds of new vulnerabilities are being discovered a year – hundreds of new ones a year. There is no way to automatically report and index these bugs, but we can change again.”]
Source: https://www.csoonline.com/article/3444496/autonomy-and-the-death-of-cves.html