OK, remember you asked for it<p>&quot;If you know otherwise, then please cite the specific CVEs. Otherwise, you&#x27;re just spreading false information&quot;<p>man, you are so full of it<p>want proof ? no problemo<p>1. CVE are organised by vendors and products<p>HTML and JS does not show as products, only browsers<p>see <a href="http:&#x2F;&#x2F;www.cvedetails.com&#x2F;top-50-products.php" rel="nofollow">http:&#x2F;&#x2F;www.cvedetails.com&#x2F;top-50-products.php</a><p>look #3 Firefox, #4 Chrome, #8 IE<p>that explains why you will never see a specific HTML and&#x2F;or JS CVE, that does not mean they don&#x27;t exists.<p>Also in term of volume, browsers have more CVE than Flash, it&#x27;s all here in the numbers: Firefox 1320, Chrome 1216, but no let&#x27;s ignore them and focus on Flash 713 CVE.<p>Just that it make your whole argument biased, the part &quot;JavaScript itself has been pretty stable for years&quot; is ridiculous, search for JS blackhole exploit, Rowhammer.js exploit, Heap Overflow exploit in JS, etc. you don&#x27;t see them in CVE but they are here and exploitable.<p>It&#x27;s better to think than JS is secure looking at that
<a href="http:&#x2F;&#x2F;www.cvedetails.com&#x2F;vendor&#x2F;10288&#x2F;Javascript.html" rel="nofollow">http:&#x2F;&#x2F;www.cvedetails.com&#x2F;vendor&#x2F;10288&#x2F;Javascript.html</a><p>yeah no exploit in JS, none, we are all safe LOL<p>this for example  
<a href="http:&#x2F;&#x2F;www.cvedetails.com&#x2F;cve&#x2F;CVE-2015-0817&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.cvedetails.com&#x2F;cve&#x2F;CVE-2015-0817&#x2F;</a>  
<a href="http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2015-0817" rel="nofollow">http:&#x2F;&#x2F;cve.mitre.org&#x2F;cgi-bin&#x2F;cvename.cgi?name=CVE-2015-0817</a>  
<a href="https:&#x2F;&#x2F;www.mozilla.org&#x2F;en-US&#x2F;security&#x2F;advisories&#x2F;mfsa2015-29&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.mozilla.org&#x2F;en-US&#x2F;security&#x2F;advisories&#x2F;mfsa2015-2...</a><p>you don&#x27;t see it show up under the tag &quot;JavaScript&quot;<p>2. Number of CVE listed do no equals CVE exploited in the wild<p>so you say &quot;It averages to about 1 every 3 days&quot;, that&#x27;s completely false<p>1 vendor patch for a particular product can close numerous CVE at the same time so it&#x27;s more like &quot;we squashed 50 CVE in 1 day&quot;<p>look at <a href="http:&#x2F;&#x2F;www.cvedetails.com&#x2F;cve&#x2F;CVE-2015-8449&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.cvedetails.com&#x2F;cve&#x2F;CVE-2015-8449&#x2F;</a><p>follow up on <a href="https:&#x2F;&#x2F;helpx.adobe.com&#x2F;security&#x2F;products&#x2F;flash-player&#x2F;apsb15-32.html" rel="nofollow">https:&#x2F;&#x2F;helpx.adobe.com&#x2F;security&#x2F;products&#x2F;flash-player&#x2F;apsb1...</a><p>that&#x27;s 1 patch, it does not indicate 1 CVE every 3 days, look at the details<p>&quot;These updates resolve use-after-free vulnerabilities that could lead to code execution (CVE-2015-8050, ...&quot; that&#x27;s more than 50 CVE of the same type patched 
and closed at the same time<p>Also look the &quot;Acknowledgments&quot;, numerous security team reported all those CVE for them to be patched, there is no indications they were exploited in the wild.<p>Saying such things as &quot;oh 30 CVE discovered in 1 month, so that means there were 1 CVE per day&quot; is totally misleading, even more misleading to assume all those CVE were exploited by default (eg. &quot;could lead to&quot;).<p>At best it indicates that they (Adobe and other security team) are more serious about discovering and patching those CVE and so they close more of them more often.