The graph would've been stronger if other versions were included. Something like this is for example, (it's lowk a bad example though since i can't really tell much about what the author is claiming as an effect of the figure)

https://www.blogspan.net/linux-kernel-cve-2026-98432-tcp-ubuntu-fix/

Which shows compared to previous years a similarish rise in cves but they appear more trivial (for a variety of reasons such as enhancing requitements to be high risk cve)? Would be worth replication