{
 "retrieval_date": "2026-11-12",
 "codebook": "1.0 (frozen 2026-11-12, before labelling)",
 "n_cves": 1199,
 "by_year_published": {
  "2023": 28,
  "2024": 98,
  "2025": 211,
  "2026": 862
 },
 "by_year_same_window_jan1_to_nov12": {
  "2023": 24,
  "2024": 95,
  "2025": 179,
  "2026": 862
 },
 "by_product": {
  "Langflow": 240,
  "Open WebUI": 176,
  "Flowise": 152,
  "vLLM": 134,
  "LangChain (Python)": 63,
  "Gradio": 52,
  "LiteLLM": 50,
  "Dify": 50,
  "MCP servers and tools": 45,
  "AutoGPT": 40,
  "MCP SDKs": 34,
  "Hugging Face transformers": 33,
  "Ollama": 33,
  "Cursor": 31,
  "LlamaIndex": 29,
  "CrewAI": 11,
  "text-generation-webui": 9,
  "LangChain (JS)": 8,
  "Cline": 3,
  "Haystack": 2,
  "Continue": 2,
  "Semantic Kernel": 2
 },
 "by_group": {
  "Low-code LLM builder": 442,
  "Model serving": 176,
  "Chat front end": 176,
  "LLM app framework": 104,
  "MCP": 79,
  "ML web UI": 52,
  "Agent platform": 51,
  "LLM gateway": 50,
  "Agentic IDE": 36,
  "Model loading": 33
 },
 "by_group_year": {
  "LLM app framework": {
   "2023": 17,
   "2024": 21,
   "2025": 32,
   "2026": 34
  },
  "ML web UI": {
   "2023": 5,
   "2024": 29,
   "2025": 10,
   "2026": 8
  },
  "Model loading": {
   "2023": 3,
   "2024": 4,
   "2025": 20,
   "2026": 6
  },
  "Agent platform": {
   "2023": 3,
   "2024": 4,
   "2025": 8,
   "2026": 36
  },
  "LLM gateway": {
   "2024": 9,
   "2025": 8,
   "2026": 33
  },
  "Low-code LLM builder": {
   "2024": 15,
   "2025": 47,
   "2026": 380
  },
  "Model serving": {
   "2024": 9,
   "2025": 39,
   "2026": 128
  },
  "Chat front end": {
   "2024": 5,
   "2025": 13,
   "2026": 158
  },
  "Agentic IDE": {
   "2024": 2,
   "2025": 19,
   "2026": 15
  },
  "MCP": {
   "2025": 15,
   "2026": 64
  }
 },
 "match_method": {
  "ghsa_package": 668,
  "nvd_cpe": 408,
  "nvd_keyword_confirmed": 123
 },
 "severity": {
  "n_scored": 1199,
  "n_unscored": 0,
  "counts": {
   "CRITICAL": 210,
   "MEDIUM": 412,
   "HIGH": 551,
   "LOW": 26
  },
  "high_or_critical": 761,
  "high_or_critical_pct": 63.5,
  "critical": 210,
  "critical_pct": 17.5,
  "score_source": {
   "NVD": 453,
   "CNA": 744,
   "GHSA": 2
  },
  "high_or_critical_pct_by_year": {
   "2023": 89.3,
   "2024": 69.4,
   "2025": 71.1,
   "2026": 60.1
  },
  "median_cvss": 7.5
 },
 "top_cwes": [
  [
   "CWE-94",
   127
  ],
  [
   "CWE-918",
   121
  ],
  [
   "CWE-22",
   107
  ],
  [
   "CWE-639",
   76
  ],
  [
   "CWE-862",
   73
  ],
  [
   "CWE-400",
   56
  ],
  [
   "CWE-79",
   52
  ],
  [
   "CWE-863",
   52
  ],
  [
   "CWE-200",
   45
  ],
  [
   "CWE-284",
   44
  ],
  [
   "CWE-502",
   42
  ],
  [
   "CWE-78",
   39
  ]
 ],
 "n_with_any_cwe": 1195,
 "attack_class": {
  "AUTH_BYPASS": 284,
  "DOS": 153,
  "PATH_TRAVERSAL": 137,
  "CODE_INJECTION": 130,
  "SSRF": 115,
  "SECRET_LEAK": 58,
  "XSS_HTML": 56,
  "UNSAFE_DESERIALIZATION": 51,
  "CMD_INJECTION": 42,
  "OTHER": 38,
  "PI_CODE_EXEC": 37,
  "CSRF_ORIGIN": 34,
  "SQL_INJECTION": 23,
  "PI_OTHER_SINK": 22,
  "MEMORY_SAFETY": 19
 },
 "code_or_command_execution_classes": {
  "n": 260,
  "pct": 21.7
 },
 "llm_output_to_dangerous_sink": {
  "n": 59,
  "pct": 4.9,
  "sink_types": {
   "exec": 36,
   "file_path": 9,
   "url_fetch": 5,
   "sql": 5,
   "html_render": 4
  },
  "by_year": {
   "2023": 5,
   "2024": 10,
   "2025": 17,
   "2026": 27
  }
 },
 "fix": {
  "n_fix_version_listed": 898,
  "n_with_fix_release_date": 818,
  "median_days_fix_release_minus_publish": -23.0,
  "n_fix_released_on_or_before_publish": 766,
  "pct_fix_released_on_or_before_publish": 93.6,
  "n_fix_released_after_publish": 52,
  "median_days_when_fix_after_publish": 21.0,
  "p90_days_when_fix_after_publish": 63,
  "n_no_fixed_version_listed": 301
 },
 "coder_agreement": {
  "n_pairs": 1199,
  "class_pct": 78.9,
  "class_kappa": 0.762,
  "llm_sink_pct": 92.7,
  "llm_sink_kappa": 0.295,
  "n_adjudicated": 257,
  "n_unadjudicated": 0,
  "final_vs_coder2_class_pct": 98.4,
  "final_vs_coder1_class_pct": 79.7
 },
 "kh_control_counts": {
  "pre-launch red-team testing": 642,
  "injection-safe tool gate with least-privilege tools": 346,
  "monitoring and a kill switch": 153,
  "spend caps and key hygiene": 58
 },
 "mcp_wide_sweep": {
  "query": "NVD keywordSearch 'mcp server' + 'model context protocol', desc matches MCP, 2023+",
  "n": 563,
  "by_year": {
   "2025": 69,
   "2026": 494
  },
  "by_half": {
   "2025H1": 8,
   "2025H2": 61,
   "2026H1": 145,
   "2026H2": 349
  },
  "n_scored": 562,
  "high_or_critical": 348,
  "first_published": "2025-05-01"
 },
 "llm_sink_high_or_critical": 54,
 "llm_sink_critical": 25,
 "ghsa_reviewed_advisories_in_scope_without_cve": 43,
 "keyword_only_hits": {
  "reviewed": 197,
  "accepted": 123
 },
 "cna_by_year_top": {
  "2023": [
   [
    "cve@mitre.org",
    17
   ],
   [
    "security-advisories@github.com",
    6
   ],
   [
    "security@huntr.dev",
    5
   ]
  ],
  "2024": [
   [
    "security@huntr.dev",
    41
   ],
   [
    "security-advisories@github.com",
    23
   ],
   [
    "cve@mitre.org",
    20
   ],
   [
    "vulnreport@tenable.com",
    4
   ],
   [
    "zdi-disclosures@trendmicro.com",
    3
   ]
  ],
  "2025": [
   [
    "security-advisories@github.com",
    90
   ],
   [
    "security@huntr.dev",
    82
   ],
   [
    "cve@mitre.org",
    18
   ],
   [
    "zdi-disclosures@trendmicro.com",
    11
   ],
   [
    "disclosure@vulncheck.com",
    3
   ]
  ],
  "2026": [
   [
    "security-advisories@github.com",
    428
   ],
   [
    "psirt@us.ibm.com",
    185
   ],
   [
    "disclosure@vulncheck.com",
    153
   ],
   [
    "cna@vuldb.com",
    49
   ],
   [
    "cve@mitre.org",
    13
   ]
  ]
 },
 "nvd_queries": 125
}