Ninety-one percent of codebases contained components that were 10 or more versions out-of-date, and 49% of codebases contained components that had no development activity within the past two years. The report also found that the mean age of open source vulnerabilities in the codebases was over 2.5 years old, and nearly a quarter of codebases contained vulnerabilities more than 10 years old.

High-risk open source vulnerabilities permeate across critical industries: The computer hardware and semiconductors industry had the highest percentage of codebases with high-risk open source vulnerabilities (88%), followed closely by manufacturing, industrials and robotics at 87%. Closer to the middle of the pack, the big data, AI, BI and machine learning industry had 66% of its codebases impacted by high-risk vulnerabilities. At the bottom of the list, the aerospace, aviation, automotive, transportation and logistics industry still had high-risk vulnerabilities in a third (33%) of its codebases.

The report found that over half (53%) of the codebases contained open source license conflicts, and 31% of codebases were using code with either no discernible license or a customized license. The majority of the open source vulnerabilities that were observed most frequently in this research are classified as Improper Neutralization weaknesses (CWE-707).

Read the full report here.