The number of CVE records against a product gets treated as a sign of how insecure it is. I wanted to know whether the count mostly reflects the software, or how many people happened to be looking and who was issuing the records.
Studies going back to 2005 find the discovery rate depends on effort, and effort is almost never measured; in bug bounties, more researchers and higher rewards reliably produce more reports. Who issues records has changed a great deal. MITRE issued 45% in 2017 and 11% in 2025, while organisations publishing flaws found in other people's products issued 42% in 2025, and four issuers account for 88% of the rise between 2023 and 2025. After the Linux kernel began issuing its own in 2024, kernel records rose about nineteen times, and its stated policy is to issue one for nearly every bug fix. Records published in the first nine months of 2026 doubled on 2025. In the studies I found, few recorded vulnerabilities were ever exploited, and exploitation didn't rise in step with the count.
There's a decent case the other way. One project's count fell as old code was cleaned up. Android's share of memory-safety bugs dropped sharply after a change of programming language. Studies that hold testing effort fixed do find real differences between products, and browser data controlling for attention suggests a limited pool of easy bugs that hunting gradually uses up. No study I found controlled for effort, popularity and issuer together.
So it depends what you're comparing. Raw totals across products or years mainly reflect attention and issuing practice. Within a single product, tracked by bug type under a stable process, counts can show real change. I wouldn't rank products by CVE totals, and when a count jumps I'd look at who issued the records before concluding anything.