vulndensity

Every dot of heat is a security flaw that sat in the code, silicon or spec from the year on the x-axis until someone reported it in the year on the y-axis. Distance above the diagonal is how long it lurked.

all vulnerabilities

The dataset is hand-curated from public write-ups of famous flaws that have a documented origin, so it skews toward the ones with names and logos. Introduction years are approximate (first release, silicon generation or spec containing the bug); discovery is the year first reported. Nothing below the diagonal is possible, and nothing is a census.