No.<p>Firstly the data aren&#x27;t usable for this kind of analysis even if you bucket them differently: <a href="https:&#x2F;&#x2F;www.cvedetails.com&#x2F;how-does-it-work.php" rel="nofollow">https:&#x2F;&#x2F;www.cvedetails.com&#x2F;how-does-it-work.php</a><p>Secondly, we know nothing about exposure, because we don&#x27;t know how the relative levels of attention or how quickly the vulnerabilities are patched.<p>A high discovery rate is as indicative of the attention given to the platform as it is to the underlying number of vulnerabilities.  A high discovery rate plus relatively high rate of distribution of patches could means a system is <i>less</i> vulnerable.<p>I&#x27;m not saying this is the case - just that the data presented are simply useless for ranking software vulnerability levels.