Secondly, we know nothing about exposure, because we don't know how the relative levels of attention or how quickly the vulnerabilities are patched.
A high discovery rate is as indicative of the attention given to the platform as it is to the underlying number of vulnerabilities. A high discovery rate plus relatively high rate of distribution of patches could means a system is less vulnerable.
I'm not saying this is the case - just that the data presented are simply useless for ranking software vulnerability levels.
Firstly the data aren't usable for this kind of analysis even if you bucket them differently: https://www.cvedetails.com/how-does-it-work.php
Secondly, we know nothing about exposure, because we don't know how the relative levels of attention or how quickly the vulnerabilities are patched.
A high discovery rate is as indicative of the attention given to the platform as it is to the underlying number of vulnerabilities. A high discovery rate plus relatively high rate of distribution of patches could means a system is less vulnerable.
I'm not saying this is the case - just that the data presented are simply useless for ranking software vulnerability levels.