Or being introduced. Or neither of those two, because it's an isolated graph devoid of larger context

But we don't have enough information here; it says "CVE fixes per release", we don't know anything about them. Are these long-standing? Is some new process introducing security issues? We also have ongoing conversions of modules to rust, and lots of ongoing work.

We can say AI tools are helping find these, and that may be true, but but this graph doesn't say that, it just says "CVE Number Big".