New vulnerabilities are reported all the time in open source code and applications and that’s all good – it’s a healthy part of the ecosystem. By finding vulnerabilities, they can be fixed, rather than just staying dormant in the shadows for attackers to exploit. Over the past decade, there have been a few high profile open source vulnerabilities, that made some substantial impact. All of the issues were patched in short order by the upstream projects, but not every user patched quickly, leaving some exposed to risk.