Counting CVEs is not a good way of comparing security between software.