Jan 92026 The State of Trusted Open Source Analysis shows most security risk sits in longtail open source images, with 98% of CVEs outside top projects & Critical flaws fixed in under 20 hours.