since 2003 was a low-output year for CVE and thus the
concentration was in high-priority software.
Some vulnerability types are probably under-represented due to
classification difficulty. For example, the ‘form-field’ type (web