Firstly, all of my data and graphs come from the NVD CVE json data. The MITRE data isn’t public, I can’t be certain where that number came from, and the NVD data is quite a bit different. If we look at the left side, the NVD-CWE-Other data just means we don’t have CWE names for that old data.