Approximately 0 Heartbleeds.

A Heartbleed-level vulnerability means "everyone is vulnerable, exploitation is trivial, consequences of exploitation are severe" so therefore you need to a) update yesterday and b) assume that the fact you haven't updated yet (because you just found out) means you've already been screwed. These kind of bugs are very rare, and the only comparable one I can think of is Debian's OpenSSL bug.