Most vulnerabilities probably aren't due to the language but the application writers, simply because there are more eyes on the language than the application.