The signal was always there.
An analysis of 2,846 runtime-confirmed vulnerabilities across enterprise environments — what the data reveals about real risk, scoring gaps, ecosystem shifts, and the acceleration of ingress-exposed threats in early 2026.
2,846
CVEs detected at runtime
4.5%
Genuinely actionable
0.07%
Actively executing threats
24%
Ingress exposure rate, Mar 2026
Aggregated, anonymized data from Kodem customer environments. No customer-identifying information is present in this report.
Confidential Q1 2026
Executive Summary
What 2,846 runtime findings actually tell us
Most vulnerability reports describe the landscape from the scanner's perspective. This one describes it from production. The difference is not incremental — it changes almost every conclusion.
Kodem's runtime intelligence layer observed 2,846 CVEs across enterprise environments through Q1 2026. Traditional scanners would have reported all 2,846 at roughly equal urgency. Runtime context tells a different story: only 127 of these warrant elevated attention, and just 2 represent actively executing threats. Both of those 2 are Log4Shell variants — still running in production four and a half years after disclosure.
Simultaneously, three structural shifts are underway that conventional security tooling isn't designed to surface. Go's standard library has become the dominant vulnerability surface in cloud-native environments, eclipsing Java without a corresponding shift in tooling maturity. Ingress-exposed critical findings accelerated dramatically in early 2026. And JavaScript's package ecosystem has emerged as the only software supply chain surface where malicious-package attack vectors appear in real production runtime data.
This report presents the findings, the trends, and the structural conclusions — not as a threat landscape forecast, but as a direct read of what is happening inside running systems today.
Simultaneously, three structural shifts are underway that conventional security tooling isn't designed to surface. Go's standard library has become the dominant vulnerability surface in cloud-native environments, eclipsing Java without a corresponding shift in tooling maturity. Ingress-exposed critical findings accelerated dramatically in early 2026. And JavaScript's package ecosystem has emerged as the only software supply chain surface where malicious-package attack vectors appear in real production runtime data.
This report presents the findings, the trends, and the structural conclusions — not as a threat landscape forecast, but as a direct read of what is happening inside running systems today.
95.5%
of findings are runtime noise —real CVEs, not real fires
98.3%
of vulnerabilities are intransitive dependencies
37.7%
of all runtime issues arein the Go ecosystem
10×
quarterly discovery growth
from 2025 to Q1 2026
Finding 01
The 95.5% Problem
Security scanners are generating approximately twenty times the actionable work. Runtime context collapses 2,846 CVEs into 127 elevated risks — and 2 actively executing threats.
“The problem isn't that security teams miss vulnerabilities. It's that they're handed 2,846 and asked to prioritize without the context to know that 2 of them are on fire.”
Log4Shell is still executing in 2026
CVE-2021-44228 and CVE-2021-45046 — the Log4Shell family — remain the only findings in this dataset where Kodem can confirm that vulnerable code paths are actively being called in production. Not the package loaded. The functions executing.This is not a scan artifact. It is four and a half years after the most-covered security disclosure in history, with "we patched Log4Shell" as a standard answer on security questionnaires. Function-execution-level runtime visibility tells a different story.
The EPSS reality check
Across all 2,846 findings, the median EPSS score — the metric that measures actual attacker exploitation probability — is 0.04%. Only 1.1% of issues have an EPSS score above 50%.
CVSS, which measures theoretical severity, scores 4.8% of findings as Critical (≥9.0) and 121 total in that band. The gap between what looks dangerous and what is being exploited is not a rounding error — it is the fundamental flaw in scanner-driven security programs.
CVSS, which measures theoretical severity, scores 4.8% of findings as Critical (≥9.0) and 121 total in that band. The gap between what looks dangerous and what is being exploited is not a rounding error — it is the fundamental flaw in scanner-driven security programs.
Finding 02
The Acceleration
Discovery volume grew 10× from 2025 to Q1 2026. Ingress exposure — the proportion of findings with confirmed internet-facing reach — is rising sharply. These are not independent trends.
Volume explosion in Q1 2026
Quarterly discovery volume grew from roughly 130–260 issues across all of 2025 to 1,417 in Q1 2026 alone — with March 2026 producing 619 findings in a single month. The primary driver is not more environments being onboarded; it is the CVE publication rate. The Go standard library released a concentrated cluster of new CVEs in early 2026, and each one replicates across every project in scope.
Ingress exposure is the real alarm
Through most of 2025, fewer than 3% of monthly discoveries had confirmed internet-facing exposure. By March 2026, that figure reached 23.6% — nearly one in four newly found issues has a confirmed external attack path. In the same month, 49 were Critical severity. This is a convergence, not a coincidence: more external services, higher CVE density, less time to remediate.
Finding 03
The Go Reckoning
Go's standard library has become the single largest vulnerability surface in cloud-native environments. Security tooling, developer training, and exploit research have not kept pace.
37.7%
of all runtime issues are in the Go ecosystem
1,072 of 2,846 total findings
22.6%
from Go stdlib alone — more than Java, Python & JS combined
643 issues from standard library
743
Go issues discovered in Q1 2026 alone
Up from 33 in all of 2025-Q1
The Go standard library’s security posture has changed materially in 2025–2026. A concentration of newly published CVEs — many in the crypto, net/http, and archive/zip packages — drove a cascade of findings across every environment running Go services. The top two weakness classes in the Go findings are CWE-770 (Allocation without Limits) and CWE-295 (Improper Certificate Validation) — neither of which maps to the RCE-centric threat models that dominate security prioritization frameworks.
The broader Go ecosystem surfaces similarly:
The ecosystem shift is stark in the quarterly data. Go was a minor contributor to the 2024 findings. By Q1 2026, it accounts for more than half of all newly discovered issues — a structural change driven by the intersection of Go’s growing market share in cloud-native infrastructure and an accelerating CVE publication cadence from the Go security team.
The broader Go ecosystem surfaces similarly:
golang.org/x/crypto, google.golang.org/grpc, and golang.org/x/net each appear in the top 10 affected packages, with gRPC carrying an active “in the wild” exploitation record via HTTP/2 Rapid Reset (CVE-2023-44487).The ecosystem shift is stark in the quarterly data. Go was a minor contributor to the 2024 findings. By Q1 2026, it accounts for more than half of all newly discovered issues — a structural change driven by the intersection of Go’s growing market share in cloud-native infrastructure and an accelerating CVE publication cadence from the Go security team.
Finding 04
The Scoring Gap
CVSS measures theoretical impact. EPSS measures actual attacker behavior. In this dataset, the two produce near-opposite risk pictures — and security teams are optimizing for the wrong one.
30.5% of all findings have CVSS ≥ 7 but an EPSS score below 5%. The median EPSS across 2,846 issues is 0.04%.
The implication is direct: security programs built around CVSS are making prioritization decisions on a metric that describes theoretical blast radius, not attacker interest. The 869 "paper tiger" issues — high CVSS, near-zero EPSS — absorb remediation capacity that should be directed at the 31 findings with genuine exploitation probability.
Finding 05
The Transitive Dependency Trap
Go's standard library has become the single largest vulnerability surface in cloud-native environments. Security tooling, developer training, and exploit research have not kept pace.
98.3%
of vulnerabilities are in transitive dependencies — code teams never directly chose to include
Only 49 of 2,846 issues (1.7%) are in packages that engineering teams directly declared as dependencies. The remaining 98.3% arrived via transitive pulls — second, third, or fourth-order dependencies of things teams did choose.
Standard security advice — "update your dependency" — is inapplicable to 98% of production vulnerabilities. Most require upstream maintainer action, base image updates, or runtime-level mitigation. This reframes the "developer-first security" motion: developers are not the correct fix path for the overwhelming majority of runtime exposure.
Of the 49 direct dependencies with CVEs, the severity profile is actually more favorable: 2 Critical, 18 High, 20 Medium. The highest-risk transitive issues carry 119 Critical findings — severity concentrated in the very code that developers have the least visibility into and the least direct control over.
Standard security advice — "update your dependency" — is inapplicable to 98% of production vulnerabilities. Most require upstream maintainer action, base image updates, or runtime-level mitigation. This reframes the "developer-first security" motion: developers are not the correct fix path for the overwhelming majority of runtime exposure.
Of the 49 direct dependencies with CVEs, the severity profile is actually more favorable: 2 Critical, 18 High, 20 Medium. The highest-risk transitive issues carry 119 Critical findings — severity concentrated in the very code that developers have the least visibility into and the least direct control over.
The won't-fix CVE tax — 247 issues that will never leave the dashboard
A cluster of ancient glibc vulnerabilities — CVE-2010-4756, CVE-2018-20796, CVE-2019-1010022 through 1010025, CVE-2019-9192, and CVE-2018-5709 — appear identically 33 times each across these environments. These are well-documented "won't-fix" entries: the glibc maintainers dispute exploitability, distros do not patch them, and they have appeared in security reports since before many current engineers started their careers. They represent 8.7% of all issues and will appear in every future scan, permanently depressing metric quality and fatiguing review teams.
Finding 06
The Supply Chain Picture
Across all 2,846 runtime findings, every supply chain attack indicator appears in the same ecosystem: JavaScript. And a separate, underexamined threat vector — developer tools running in production — surfaces as the dataset’s single hottest actionable finding.
01
JavaScript is the sole supply chain surface
17 issues across the dataset reference malicious package delivery, supply chain compromise, or backdoor-adjacent mechanics in their CVE descriptions. Every one of them is a JavaScript package. pnpm alone accounts for 7 CVEs (2025–2026) explicitly describing malicious package installation paths and path traversal during package install execution.
02
git is in production — and exploited
CVE-2025-48384 in the git binary is the hottest finding in the dataset by combined criteria: exploited in the wild, ingress-exposed, and running as an active package in a production container. Git is a developer tool with no legitimate reason to be in a production image. Image hygiene failure created a confirmed, exploited attack surface.03
96 issues in developer tooling at runtime
git (44 issues), nodejs (38), pip (6), docker daemon (4), GitHub CLI (3), and playwright (1) are all present in runtime environments. These packages have no place in production containers. Their presence reflects CI/CD artifacts carried into production images — and each one extends the attack surface in ways application dependency scanning cannot model.
04
No malicious package category in runtime data
The dataset contains no MAL-* OSV IDs, no flagged typosquats, no protestware entries. All 2,846 issues are classified as Package Vulnerability. This reflects a gap in the pipeline — runtime context can confirm which vulnerable packages execute, but not yet which loaded packages have been tampered with upstream. This is the next frontier for runtime intelligence.
Developer tools found running in production runtime
44
git CVEs
1 exploited in wild +
ingress=TRUE38
Node.js CVEs
13 with ingress exposure
4
Docker daemon CVEs
All with ingress exposure
CVE-2025-61732: The Go stdlib code injection sleeper
This single CVE — Code Injection in Go’s cmd/go via malicious
#cgo pkg-config directives — appears 41 times across the dataset. The attack mechanism (malicious module version strings triggering local code execution) is precisely the supply chain attack pattern that targets CI/CD pipelines. No in-the-wild exploitation is yet recorded. It carries the exact technical profile of vulnerabilities that get weaponized between observation and remediation.Finding 07
Structural Risk: What the CWE Data Says
The top weakness class in this dataset is denial-of-service, not remote code execution. The second is certificate validation failure. Both are systematically underweighted in conventional security programs.
#1 Weakness Class
CWE-770 · Allocation without Limits
271 issues. Concentrated in Go stdlib (165) and golang.org/x/crypto (34). These are denial-of-service class vulnerabilities — an attacker can exhaust memory or processing by sending a crafted payload. Security teams optimize for RCE and data exfiltration. Availability risk, particularly in cloud-native microservice architectures where a single overloaded service can cascade, is the actual runtime threat profile. It is systematically underweighted in severity scoring and board reporting alike.
#2 Weakness Class
CWE-295 · Improper Certificate Validation
173 issues, 41 of which are Critical severity. Concentrated in Go stdlib (138) and curl/libcurl. In microservice architectures where service-to-service TLS is assumed to provide security, systematic hostname verification failures create man-in-the-middle risk on internal traffic — an attack vector that application-layer scanners rarely surface prominently. This class almost never makes threat intelligence reports despite appearing at scale in production Go services.
CVE Detection Lag
70-day median from publish to detection
The median lag between CVE publication and Kodem runtime detection is 70 days. Notably, 126 issues (4.4%) were detected before NVD published them — sourced from GHSA and vendor advisories. At the other extreme, 739 issues were discovered more than a year after CVE publication and remain open. These constitute the long-tail backlog that likely never gets remediated under any resource-constrained security program.
Open Backlog
384 issues older than 1 year, still open
The median finding in this dataset was discovered 81 days ago. 384 issues (13.5%) have been open for more than a year. These are not being remediated — they have entered a permanent state of documented-but-ignored risk. For these, runtime context is not just useful for prioritization; it is the only mechanism to make a coherent case for either remediation or formal acceptance.
Conclusions
What the data demands
Seven structural conclusions follow from this dataset — each one specific, each one contradicting a dominant assumption in how enterprise security programs are run today.
01
Runtime context is not a supplement to scanning. It is the prerequisite for meaningful prioritization.
Without it, security teams work from a list of 2,846. With it, they work from a list of 127 — and 2 that are actively burning.
02
CVSS-based prioritization creates a structurally false risk picture. EPSS must be weighted alongside it.
30.5% of findings are “paper tigers” — high CVSS, near-zero exploitation probability. Security programs built on CVSS are optimizing for the wrong signal.
03
The Go ecosystem requires its own security program. Existing tooling maturity does not match its production prevalence.
37.7% of runtime issues are in Go. The security industry’s tooling, training, and exploit research remain Java-centric. This mismatch will compound as Go’s cloud-native footprint grows.
04
Developer tools in production are a confirmed, exploited attack vector — not a hygiene recommendation.
Git with a known-exploited CVE and ingress exposure is not hypothetical risk. Image build process controls are a security control, not an engineering preference.
05
Ingress exposure is accelerating. March 2026’s 23.6% rate is not a spike — it is a trend line.
Without it, security teams work from a list of 2,846. With it, they work from a list of 127 — and 2 that are actively burning.
06
The supply chain risk surface is JavaScript. Python and Go have structural protections that npm/pnpm lack.
Without it, security teams work from a list of 2,846. With it, they work from a list of 127 — and 2 that are actively burning.
07
The primary runtime threat is denial-of-service, not code execution. Security programs are built for the wrong adversary goal.
CWE-770 and CWE-400 together account for 355 issues — the largest weakness cluster in the dataset. Availability risk in interconnected microservice architectures deserves priority treatment it does not currently receive.
Methodology
This report is based on 2,846 open vulnerability findings exported from Kodem customer environments as of April 6, 2026. Data was aggregated and anonymized before analysis; no customer-identifying information — project names, repository paths, or team identifiers — is present in the findings presented here.
Runtime classification (the Runtime Type field) reflects Kodem's dynamic analysis layer, which instruments production workloads to determine whether vulnerable packages are loaded, whether vulnerable code paths are executed, and whether execution occurs in functions directly relevant to the vulnerability. The four classification levels — Vulnerable functions executed, Vulnerable classes executed, Package loaded in runtime, and Package loaded with no relevant execution — are assigned at observation time.
EPSS scores reflect the Exploit Prediction Scoring System v3 at time of export. CVE publication dates are sourced from NVD. Ingress classification reflects Kodem's network topology analysis identifying packages running in services with confirmed external network exposure. The risk tier stratification (Tier 1–3) used in this report is an analytical construct developed for this analysis and not a Kodem product feature.
Runtime classification (the Runtime Type field) reflects Kodem's dynamic analysis layer, which instruments production workloads to determine whether vulnerable packages are loaded, whether vulnerable code paths are executed, and whether execution occurs in functions directly relevant to the vulnerability. The four classification levels — Vulnerable functions executed, Vulnerable classes executed, Package loaded in runtime, and Package loaded with no relevant execution — are assigned at observation time.
EPSS scores reflect the Exploit Prediction Scoring System v3 at time of export. CVE publication dates are sourced from NVD. Ingress classification reflects Kodem's network topology analysis identifying packages running in services with confirmed external network exposure. The risk tier stratification (Tier 1–3) used in this report is an analytical construct developed for this analysis and not a Kodem product feature.
Dataset snapshot
Total issues
2,846
Export date
April 6, 2026
Issue status
Open (100%)
Ecosystems
Go, deb, JS, Python, Java, apk, Ruby
Runtime=TRUE
2,846 (100%)
Unique CVEs
~680 distinct identifiers
Discovery window
May 2024 – April 2026
published by
