There have been 10 Linux kernel CVEs issued in the last 2 months. That includes 4 code execution and/or privilege escalation vulnerabilities. That's not even counting any 0 day's that are (probably) sitting in someone's toolbox.

The point being that this isn't a Flash/Microsoft/pick your target problem, but it's an industry wide, software engineering problem.