just closed source vendor advisories that omit sufficient details
for vulnerability classification.
7) The ‘top 5’ and ‘top 10’ vulnerabilities in each year are a much
smaller percentage of total vulnerabilities in OS vendor