Black Duck 2026 Report Finds Open Source Vulnerability Counts More Than Doubled

Summary

Black Duck’s 2026 OSSRA report analyzed 947 commercial codebases and found average vulnerability counts rose 107% to 581. It also identified widespread outdated dependencies and gaps in component visibility and AI-generated code governance.

Key points

The study examined 947 commercial codebases across 17 industries, comprising 2,843 projects audited between November 2024 and October 2025.
Among audited codebases, 87% contained vulnerabilities. Mean vulnerability instances rose from 280 to 581, while mean distinct vulnerabilities increased from 154 to 237.
High-risk vulnerability prevalence fell from 81% to 78%, and critical-risk prevalence declined from 48% to 44%, despite rising overall counts.
Average open source component counts increased 30% to 1,180 per application. Sixteen percent of components required deeper analysis beyond package-manager and manifest scanning.
Ninety-three percent of codebases contained components with no development activity for more than two years; 92% contained components at least four years out of date.
Black Duck’s cited survey research found only 24% of organizations comprehensively evaluated AI-generated code for IP, licensing, security, and quality risks.
The report cautions that AI adoption alone does not explain rising vulnerability counts; dependency growth and increased disclosures also contribute. It recommends broader component inventories, ongoing maintenance monitoring, and current SBOMs.

Article Details

Publisher: Black Duck
Report Period: November 2024 through October 2025
Scope: Open source security, licensing, and maintenance risks in audited commercial and proprietary codebases across 17 industries, supplemented by Black Duck surveys and supply chain attack examples.
Sample Size: 947 codebases comprising 2,843 projects and representing 197 M&A transactions.
Key Statistics: 98% of audited codebases contained open source; mean open source components per application increased 30% year over year, from 911 to 1,180.
87% of audited codebases contained vulnerabilities. Mean vulnerability instances per codebase increased 107%, from 280 to 581; the median was 78 and the mean distinct vulnerability count was 237.
68% of audited codebases contained license conflicts, up from 56% in the previous report; 59% had conflicts when component-to-component issues were excluded.
93% of audited codebases contained components with no development activity for over two years, and 92% contained components at least four years out of date.
16% of identified open source components required deeper analysis beyond package-manager and manifest scanning, including snippet matching, binary analysis, and manual review.
Recommendations: Combine dependency scanning with snippet, binary, and file-matching analysis to identify components outside declared manifests.
Maintain current SBOMs covering direct and transitive dependencies and identified AI models, updating them with product changes and patches.
Evaluate component maintenance trajectories before adoption and continuously monitor dependency age, version currency, and upstream viability.
Establish automated vulnerability triage and reporting processes capable of meeting the CRA reporting timelines described in the report.
Govern AI-assisted development through visibility into tool usage and comprehensive security, licensing, IP, and quality evaluations integrated into developer workflows.