Can Stack Overflow Predict the Future? Using Developer Question Volume to Forecast CVE Disclosures Across Technology Categories

We investigate whether Stack Overflow question volume for specific technologies improves month-ahead forecasting of Common Vulnerabilities and Exposures (CVE) disclosures. Using 15 years of Stack Overflow data (2010-2024) and National Vulnerability Database (NVD) records across 15 technologies initially selected, 14 of which were modeled, spanning four categories (languages, frameworks, databases, and OS/infrastructure), we fit negative binomial baseline models using lagged CVE counts and compare them to Poisson LASSO models augmented with lagged Stack Overflow question volumes. SO-augmented models reduce RMSE by up to 94% for high-traffic technologies. Granger causality tests confirm that Stack Overflow activity statistically precedes CVE disclosures for Python (lags 1-3, p < 0.05) and PHP (lags 1-3, p < 0.05). The strongest predictive signal appears at a 6-month lag, particularly for database and language categories. These findings suggest that public developer activity on Q&A platforms contains latent signals about emerging software vulnerabilities.