Likely a huge amount. The recent PHP ones are a prime example of this. But it also means now more than ever they cannot be ignored or dismissed as "nah thats too hard for someone to figure out how to break in" as it's simply no longer true.