Empirical Vulnerability Analysis and Threat Vector Mapping Across Major Software Ecosystems

The volume of newly disclosed Common Vulnerabilities and Exposures (CVEs) routinely overwhelms enterprise security teams. Without automated, risk-driven processing, organizations struggle to allocate remediation resources effectively. This paper introduces a custom Python data pipeline (nvd_analysis.py) that pulls and processes records from the NIST National Vulnerability Database (NVD) API v2.0. By ingesting and normalizing a 30-day snapshot of global vulnerability metadata (N = 8,844), this study maps vulnerability volume, severity (CVSS v2/v3.x), and attack vectors across four major ecosystems: Microsoft, Linux, Apple, and Google. Results show that remote network exploitation drives 77.8% of the global threat surface. Meanwhile, enterprise server platforms (Linux and Microsoft) carry the highest average CVSS severity ratings (7.37 and 7.30). The paper outlines practical recommendations for corporate patch prioritization, Zero Trust implementation, and software supply chain auditing.