This is an interesting list, but I wonder about the definition of "vendor". Seeing the distribution makers in the list, I had a look at Debian's CVEs, and I sa

This is an interesting list, but I wonder about the definition of "vendor". Seeing the distribution makers in the list, I had a look at Debian's CVEs, and I saw that the counts included CVEs for software being packaged/distributed by Debian. Then you have the entities that I feel perfectly fit the "Vendor" descriptor: Adobe, Microsoft, etc.. Then you have Oracle at the top, but I expect that number is a combination of vulnerabilities in products produced by Oracle (like Java), and vulnerabilities reported in Oracle Linux. I wish there was a better distinction between "distributor" (or "software packager") vs. "software creator".