There is no plugging all of the holes. Not in a general case. It's like the halting problem (it's technically equivalent) - maybe you can say for one program there are no holes, but not for arbitrary programs, for arbitrary definitions of holes.

This is rice's theorem.

More practically, you can simply assume that for an arbitrary program of 'reasonable size' with a moving codebase there are effectively infinite exploitable vulnerabilities.