able to conduct these analyses themselves. In many cases, an evaluation is likely to be
unpublished.
Clues are still available, however, in the extensive information about the published
vulnerabilities for many products. While comparing the raw number of vulnerabilities