I wonder why no "mbedTLS" or LibTomCrypt? The formeris very popular in IoT devices, which is where a lot of hacking is happening. I'm guessing no stats were available for those two.

It is interesting to see the trend split between crypto and non-crypto vulnerability. There is only one trendline, LOC, but I would like to see CVE trends over time as well because that would indicate if we are making progress. This is useful framework for a longer-term study.