> knowing what bugs exist or other issues that effect security is hard
I agree. For example, according to [1]: "In the autumn of 2004, [Dan] Bernstein taught a [University of Chicago graduate level] course about computer software security, titled "UNIX Security Holes". The sixteen members of the class discovered 91 new UNIX security holes. Bernstein, long a promoter of the idea that full disclosure is the best method to promote software security and founder of the securesoftware mailing list, publicly announced 44 of them with sample exploit code."
This was 15 years ago, but it does reveal just how hard it is to know how many vulnerabilities are out there.
However, knowing what bugs exist or other issues that effect security is hard. Let alone comparing.