SQLite had a vulnerability recently[0], despite being considered one of the most thoroughly tested projects out there. The reason why not is combinatorial explosion[1]: because complex software has so many possible inputs and states, it is not feasible for tests to cover every possible edge case.

[0] https://news.ycombinator.com/item?id=18685296

[1] https://en.wikipedia.org/wiki/Combinatorial_explosion