Good Data For Bad Golf

I play golf. I am not good at golf. But I have a Garmin Approach R10 launch monitor, a Python interpreter, and too much free time, so naturally I spent way more time building a dashboard to analyze my swing data than I did actually swinging a club.

The result is jgamblin/golf, a self-hosted analytics pipeline that turns your Garmin Golf app CSV exports into a multi-page GitHub Pages dashboard with zero ongoing cost and no third-party accounts required.

The Problem

The Garmin Golf app is fine. You hit balls on the range, you see your carry distances, you feel bad about your smash factor, you go home. But the data is all locked in the app, and the app doesn’t really want to help you get better. It wants to show you pretty numbers and sell you more Garmin products.

I wanted to actually use my data. So I started exporting CSVs and staring at them, which is honestly just how most of my projects start.

What It Does

Drop your range session CSV exports from the Garmin Golf app into a Data/ folder, run one command, and get a full multi-page static dashboard:

  • Overview: Session trend, miss-direction chart, session table
  • Club Lab: Per-club drilldown with path/face infographic, path cloud scatter, consistency heatmap
  • Session Replay: Full stat breakdown for every session
  • Gapping: Carry ladder, target-error chart, progress to goal chart, environment context
  • Coaching: Ranked recommendations with confidence scores
  • Data Quality: Flagged-shot trends and miss reasons

Push to GitHub and GitHub Actions automatically deploys everything to GitHub Pages on every commit. The live version of my own data is at jgamblin.github.io/golf.

The Parts I’m Actually Proud Of

Consistency Score (0–100). Rather than eyeballing my shot dispersion and feeling vague shame, the pipeline calculates a single per-club number from four R10 signals: carry distance CV, lateral deviation standard deviation, face-to-path standard deviation, and swing tempo CV. The weights are calibrated against your own bag so the score is comparable across sessions even if Garmin updates their firmware and changes something upstream.

Personal Smash Factor Benchmark. Every generic golf app compares your smash factor to some industry average that was probably set by a Tour player. This pipeline calculates your personal 90th-percentile smash factor per club from your own historical shots and only flags a strike-quality issue when you fall more than 0.08 below your own best. The benchmark grows as you improve, which I find both motivating and annoying.

Gapping Analysis. This one is genuinely useful. The pipeline compares carry distances across your bag pair-by-pair and flags bunching (clubs within 7 yards of each other, or whose carry standard-deviation windows overlap) and distance voids (gaps greater than 25 yards). It also generates aspirational carry targets so you can see a “Progress To Goal” slope chart for every club in your bag.

Environment Context. Temperature, humidity, air pressure, and air density are all pulled from your session data to calculate how many yards of carry you gain or lose per degree Fahrenheit. Turns out I hit it shorter in the cold. Groundbreaking.

Explainable Recommendations. The coaching page ranks up to eight recommendations per build, and every single one includes a confidence score, a confidence reason, and a priority explanation. No black-box models, no vibes. Just your R10 data with thresholds I can tell you about:

SignalThreshold
Avg lateral deviation≥ 10 yds → reduce miss
Face-to-path std dev≥ 6° → tighten clubface variance
Smash vs. personal 90th-pctgap ≥ 0.08 → improve contact
Tempo std dev≥ 0.35 → stabilise tempo

Quick Start

# Requires Python 3.11+
pip install -e .

# Export a session CSV from the Garmin Golf app → drop it in Data/

golf-build build --data-dir Data --output-dir output/site
open output/site/index.html

If you use uv (and you should):

uv sync
uv run golf-build build

One More Thing

The pipeline also works with Trackman 4, Rapsodo MLM2, SkyTrak, and FlightScope/Mevo+. Column name mapping is handled through a single field_aliases.yaml config file, so adding a new monitor or adapting to a Garmin app update that renames columns is a one-liner, no Python required.

All the code is at github.com/jgamblin/golf. If you have a launch monitor and too much data and not enough insight, give it a shot (pun intended, I’m sorry).

As always, reach out on Twitter/X at @jgamblin if you have questions or ideas.

Prioritizing What Matters: Bringing CVE Intelligence to Splunk

I spend a significant amount of my time thinking about EPSS, CVSS, and the inherent gaps in how we prioritize vulnerabilities. We all know the drill: a 9.8 CRITICAL that remains unexploited shouldn’t jump the line ahead of a 7.5 HIGH that is being actively used in the wild. Closing that gap between theoretical severity and actual exploitability is why I started RogoLabs and why I built cve.icu.

Today, I’m releasing an update to my CVE Intelligence TA for Splunk on Splunkbase. It is a free, open-source Splunk add-on designed to help security teams move past “CVSS-only” thinking.

What’s New in v2.0

The initial release handled basic ingestion, but the feedback I received over the past week was clear: you needed more than just a list of CVEs. You needed context, probability, and speed.

In v2.0, I’ve added three critical enrichment sources to the 327,000+ vulnerabilities in the database:

  • EPSS (FIRST): Daily probability scores to help you forecast what will be exploited in the next 30 days.
  • CISA KEV: If it’s in this catalog, it’s being exploited now. This is refreshed every 6 hours.
  • CISA SSVC: Stakeholder-Specific Vulnerability Categorization data to align your priorities with CISA’s decision-making framework.

I’ve pre-joined these signals into a Risk Priority lookup. It loads instantly with no more waiting on expensive, complex searches to tell you what to patch first.

Dashboards for Practitioners

I’ve included four Dashboard Studio v2 views to help you visualize the landscape:

  • CVE Explorer: Filter the full database by vendor, CWE, or keyword.
  • Risk Priority: This is the core of the update. It ranks CVEs by actual risk, allowing you to filter by EPSS thresholds or KEV status immediately.
  • Vulnerability Landscape: An executive-level view of posture, severity distribution, and KEV growth trends.
  • Operational Health: A simple way to monitor the add-on’s baseline and incremental delta runs.

Zero Configuration (Really)

I heard you on the setup complexity of v1.x. For v2.0, I wanted a “drop-in” experience. There are no API keys to manage and no setup pages to click through. Once installed, the modular input pulls the baseline and starts hourly updates automatically.

Open Source and Building in Public

This update exists because of the bug reports and feature requests I received from the community over the last seven days. I’m a firm believer in building in public, and your feedback directly shaped the EPSS/KEV integration and the zero-config model.

CVE Intelligence for Splunk is available now on Splunkbase and is licensed under Apache 2.0.

If you have ideas for v3.0 or run into issues, open an issue on GitHub or reach out to me on X or LinkedIn.

2025 CVE Data Review

2025 set a new baseline with 48,185 published CVEs. While the sheer volume is climbing, the median CVSS score remained surprisingly stable. We are seeing a distinct shift toward web application flaws (specifically in the CMS ecosystem) and a wider distribution of vendors, proving that vulnerabilities are spreading deeper into the supply chain.

This massive growth is exactly why I launched RogoLabs. I am building free tools like cve.icu (real-time tracking), cnascorecard.org (CNA performance), and cveforecast.org (predictive modeling) to ensure vulnerability data remains accessible and usable for the community.

The takeaway for engineers is simple: you can’t patch everything. With volume at this level, your only move is to ruthlessly prioritize based on exploitability and automate the rest.

TL;DR

In 2025, 48,185 CVEs were published, a 20.6% increase from 2024’s 39,962. The total number of CVEs since 1999 now stands at 308,920.

Note: All statistics in this report exclude rejected CVEs.

Key Statistics at a Glance

MetricValue
Total CVEs in 202548,185
Year-over-Year Change+20.6%
Critical Severity3,984
High Severity15,003
Average CVSS Score6.60
CVSS Coverage91.3%
CWE Coverage92.3%
Active CNAs365
Rejected CVEs (2025)1,787

Historical CVE Growth

The volume of published CVEs increased again in 2025, continuing the established upward trend.

CVEs by Year

Year-over-year growth fluctuates, but 2025’s 21% growth is significant compared to the previous year. This indicates that despite better tooling, the rate of discovery is outpacing our ability to remediate.

Year-over-Year Growth

The cumulative CVE count now exceeds 308,000.

Cumulative Growth

2025 Monthly Distribution

The data shows a variable rate of CVE publications throughout 2025. December exhibited the highest volume, totaling 5,500 CVEs. While December is traditionally quieter, 2025 saw an anomalous spike, with over 11% of the year’s total vulnerabilities disclosed in the final month alone.

2025 Monthly Distribution

Publication Patterns by Day of Week

Analysis of CVE publication dates reveals distinct trends linked to vendor release cycles.

Tuesday remains the king of disclosure, with 11,754 CVEs, driven largely by the industry-standard “Patch Tuesday” release cadence. The drop-off is sharp: weekdays averaged 8,918 CVEs, while weekends averaged only 1,796. Security teams can generally expect the quietest period to be Sunday.


Busiest Days of 2025

The data shows significant clustering of CVE publications. The top day, February 26th, saw nearly 800 CVEs published in a single 24-hour window. These spikes create massive “risk windows” where security teams are flooded with data.

Top Days

Top 5 Busiest Days

RankDateCVE Count
12025-02-26793
22025-12-09660
32025-12-24494
42025-06-10485
52025-01-14478

Most Vulnerable Products

Beyond vendors, specific products exhibiting the highest number of CVEs in 2025:

Top Products

The data reveals that the Linux Kernel is the single product with the most vulnerabilities (3,649). However, context is vital here: this high number reflects the transparent, open-source nature of Kernel development where every fix is often assigned a CVE, unlike closed-source operating systems that may bundle fixes.

Top 5 Products

RankProductCVE Count
1Linux Kernel3,649
2Windows 10623
3Android509
4Adobe Experience Manager377
5macOS362

CVSS Score Analysis

The distribution of CVEs across the CVSS range in 2025 reveals trends in vulnerability severity.

CVSS Distribution

The average CVSS score for 2025 was 6.60, with a median of 6.50. This indicates a concentration of vulnerabilities in the medium severity range. We observed a substantial number of vulnerabilities scoring between 7.0 and 8.9, suggesting a significant attack surface requiring immediate attention.

Severity Breakdown

SeverityCountPercentage
Critical3,9848.3%
High15,00331.1%
Medium25,55153.0%
Low1,5573.2%
Severity Breakdown

CVSS Trends Over Time

CVSS by Year

Top Weakness Types (CWE)

I analyzed the prevalence of weakness types based on the Common Weakness Enumeration. The data from 2025 reveals the most frequently observed CWEs.

Top CWEs

The Web Application Crisis: The dominance of CWE-79 (Cross-Site Scripting) with over 8,000 entries is alarming. Despite XSS being a known issue for decades, it remains the most common vulnerability class. Combined with CWE-74 (Injection), CWE-862 (Missing Authorization), and CWE-89 (SQL Injection), web vulnerabilities account for a massive portion of the 2025 landscape.

Top 5 CWEs in 2025

RankCWENameCVE Count
1CWE-79XSS8,207
2CWE-74Injection2,564
3CWE-862Missing Authorization2,224
4CWE-352CSRF1,894
5CWE-89SQL Injection1,706

CVE Numbering Authorities (CNAs)

The CVE Numbering Authority ecosystem has shifted dramatically. In previous years, major software vendors dominated this list. In 2025, we see the “WordPress Effect.”

Top CNAs

Patchstack and Wordfence—organizations dedicated to WordPress plugin security—are now top drivers of CVE volume. Patchstack (#1) alone assigned 7,007 CVEs, vastly outnumbering traditional giants like Microsoft (#6) or Google. This reflects the intense scrutiny on the third-party plugin ecosystem.

Top 5 CNAs in 2025

RankCNACVE Count
1Patchstack7,007
2VulDB5,902
3Linux5,686
4MITRE5,208
5Wordfence3,451

In total, 365 unique CNAs assigned CVEs in 2025.


Top Vendors

Which vendors had the most CVEs assigned to their products in 2025?

Top Vendors

The data shows Linux experienced the highest number of CVEs in 2025. This volume reflects its ubiquitous use and the rigorous reporting standards of the Kernel project. Microsoft and Adobe remain in the top 5, consistent with previous years, while Code-Projects (a platform for open-source code) and Apple round out the list.

Top 5 Vendors in 2025

RankVendorCVE Count
1Linux5,687
2Microsoft1,255
3Adobe829
4Code-Projects730
5Apple727

Data Quality

CVE records exhibit varying degrees of completeness. The 2025 data indicates trends in metadata availability.

Data Quality

While CVSS and CWE coverage remains high (>90%), the lag in CPE identifiers (57.6%) is a concern for automated matching tools that rely on accurate product identifiers to alert users.

2025 Data Quality Metrics

MetricCoverage
CVSS Score91.3%
CWE Classification92.3%
CPE Identifiers57.6%

Rejected CVEs

Not all CVE IDs remain active. Some are rejected due to duplicates, disputes, or invalid submissions.

Rejected CVEs

The number of rejected CVEs in 2025 remained consistent with 2024 figures, hovering around 1,787. This represents a 3.58% rejection rate, suggesting a relatively stable signal-to-noise ratio in the ecosystem.

2025 Rejection Statistics

MetricValue
Rejected CVEs in 20251,787
2025 Rejection Rate3.58%
Total Rejected (All Time)16,357

Conclusions

In 2025, the volume of reported vulnerabilities hit an all-time high, demanding continuous vigilance.

The “WordPress Effect” is the most significant trend of the year. With Patchstack and Wordfence accounting for over 10,000 combined CVEs, the sheer volume of vulnerabilities has shifted from “Core OS” issues to “Third-Party Plugin” issues. For security teams, this means your threat model must aggressively account for unvetted plugins and extensions.

Linux remains the most reported vendor, but this is a feature of open source transparency, not necessarily insecurity. Teams should focus on hardening Linux environments and ensuring they have visibility into the specific kernel modules they are running.

Finally, the dominance of CWE-79 (XSS) proves that secure coding practices are still not being effectively implemented at the development stage. Regular security assessments and aggressive input validation remain critical.

Key Takeaways from 2025

  1. Volume continues to grow: With 48,185 CVEs, 2025 set a new record in vulnerability disclosures.
  2. CNAs have shifted: WordPress security firms (Patchstack, Wordfence) now out-publish major tech giants like Microsoft and Google.
  3. Severity remains concerning: 18,987 CVEs (39.4%) were rated Critical or High severity.
  4. Old bugs die hard: XSS (CWE-79) and Injection (CWE-74) continue to dominate the weakness landscape.
  5. Data quality challenges: While improving, a significant portion of CVEs still lack complete CPE data, complicating automated matching.

Methodology

This analysis uses two primary data sources:

  1. NVD JSON – National Vulnerability Database export from nvd.handsonhacking.org
  2. CVE List V5 – Official CVE records from GitHub CVEProject/cvelistV5

All graphs and statistics were generated using Python with pandas and matplotlib.


Thank you for reading the 2025 CVE Data Review!

Data collected and analyzed on January 01, 2026.

A New Era of Transparency for CVE Data Quality

I’m incredibly excited to finally share something I’ve been pouring my heart into at RogoLabs. For those of you who caught my talk at BSidesLV, you got a sneak peek, but today it’s official: CNAScorecard.org is live!

For years, the CVE program has been our shared language for identifying vulnerabilities. But lately, we’ve all felt the growing pains. We’re seeing more CVEs with incomplete, vague, or missing data. This isn’t just a small problem; it’s a huge one that leads to alert fatigue, slow response times, and automated tools that simply can’t do their jobs.

The recent NVD backlog shined a spotlight on this issue. Thousands of CVEs were left unanalyzed, lacking critical CVSS scores and CPE data. The truth is, the responsibility for data enrichment has shifted back to the CVE Numbering Authorities (CNAs), and many simply haven’t been providing this level of detail for over a decade.

This is precisely the challenge RogoLabs was created to solve. Moving beyond just counting vulnerabilities and focusing on measuring the quality and completeness of that data. CNAScorecard.org is a core part of this mission, alongside my other projects like CVE.icu, a platform for exploring vulnerability data, and CVEForecast.org, an open-source tool that predicts annual CVE volume.

The Four Pillars of a Truly Useful CVE

A CVE needs more than a basic ID to be actionable. It needs solid information across four key pillars:

  • The Weakness (CWE): This identifies the root cause of the vulnerability (e.g., SQL Injection), helping us understand why it exists.
  • The Product (CPE): This is how we precisely identify affected software (e.g., cpe:/a:apache:http_server:2.4.54). Without a complete CPE, your scanners are flying blind. In 2024 alone, more than 14,000 CVEs were published without a CPE—more than the previous four years combined.
  • The Severity (CVSS): This gives you a score (0.0-10.0) to prioritize a vulnerability. Without it, you’re left guessing which issues to tackle first.
  • The Fix (Patch Info): The ultimate goal is to fix vulnerabilities. A CVE without a clear path to a solution—like a vendor advisory, patch link, or code commit—is just a problem statement, not a solution.

Introducing CNAScorecard.org

The old saying holds true: you can’t improve what you don’t measure. CNAScorecard.org is a public, data-driven scorecard for every CVE Numbering Authority. It gives us the objective measurement we need to demand better data across the board and helps you identify which sources you can truly trust.

The system is open-source, updates every six hours, and focuses on the last six months of CVE data to keep the information current. It scores CVE records against the four pillars, rolling those scores up into an overall quality grade for each CNA.

A Look at the Initial Data

The first results are eye-opening:

  • Foundational Completeness: 100.0%
  • Root Cause Analysis (CWE): 87.4%
  • Severity & Impact (CVSS): 88.4%
  • Software Identification (CPE): 2.0%
  • Patch Information: 4.8%

These low scores for CPE and patch links highlight a critical problem. They lead to impaired automation, endless manual research, and inaccurate reporting for security teams everywhere.

How This Helps You

CNAScorecard.org is designed to empower everyone in the security community.

  • For Defenders: Use these scores to quickly identify and act on complete CVEs. The CNA grades are a powerful trust metric for evaluating your vendors.
  • For CNAs: This is a clear benchmark to see how your disclosure processes stack up against your peers. It’s a roadmap for improvement, showing you exactly where you can enhance your data quality. High-quality disclosure is a key driver of customer trust.
  • For the Ecosystem: We’re providing a continuously updated, public metric for the health of the CVE program. This brings much-needed accountability to a federated system.

Get Involved

This project isn’t just about a website; it’s about building a better, more transparent future for vulnerability management. Every line of code, every data point, and every score on CNAScorecard.org is part of a larger mission to improve the CVE ecosystem for everyone. With the right tools and a collaborative community, we can solve the challenges facing our industry.

The entire codebase is available on GitHub, and we’d love for you to contribute, provide feedback, or use it to build your own solutions.

Vegas Bound for Security Summer Camp!

It’s that time of year again! The first week of August means my annual trip to the desert for “Security Summer Camp”—the whirlwind of BSides Las Vegas, Black Hat, and DEF CON. It’s always an exhausting but amazing week, and I can’t wait to dive in, catch up with everyone, and talk about what I’ve been working on.

This year, I’m excited to be giving two talks that dig into the weeds of the CVE ecosystem.

My Talks in Vegas

I’ll be on stage at both BSidesLV and the AppSec Village at DEF CON.

EventTalk TitleThe GistWhen & Where
BSides Las Vegas“The Art of Concealment: CVE’s Challenge with Transparency”A 20-minute dive into the “broken promise” of the CVE system. I’ll break down the four pillars of an actionable CVE (Weakness, Product, Severity, Fix) and show how incomplete data is breaking our automated tools. I’ll also introduce CNAScoreCard.org, a new RogoLabs project to bring transparency and accountability to the ecosystem by measuring data quality.Tues, Aug 5 @ 2:30 PM at the Tuscany Suites & Casino
AppSec Village
at DEF CON 33
“CVE Crisis: Navigating the Post-NVD Monolith Era”A look at the bigger picture of our strained disclosure ecosystem now that the NVD is no longer the single source of truth. With the institutional power shifting to CISA, I’ll cover how to navigate this new fragmented landscape by integrating multiple intelligence sources (CISA KEV, open-source, commercial feeds) and moving to a true risk-based vulnerability management model.Friday Afternoon, Aug 8 at the AppSec Village

Let’s Connect

The best part of this week is always the people. I’m genuinely looking forward to connecting, hearing what you’re working on, and trading stories from the trenches.

My passion project, RogoLabs, is all about bringing clarity to vulnerability intelligence through open-source tools like CVE.ICU. To celebrate that, I’ll have some of the very first-run RogoLabs stickers with me.

If you see me, please say hello! I’d love to chat about CVEs, vulnerability management, or anything else. Find me after one of my talks or just flag me down in the hallway.

You can find me on bsky, Twitter, or Mastodon (infosec.exchange) as @jgamblin or learn more about my work at RogoLabs.net.

See you in Vegas!