Just looking at the numbers is misleading: curl had a security audit last year ( https://daniel.haxx.se/blog/2016/11/23/curl-security-audit/ https://daniel.haxx

Just looking at the numbers is misleading: curl had a security audit last year ( https://daniel.haxx.se/blog/2016/11/23/curl-security-audit/ https://daniel.haxx.se/blog/2016/11/23/curl-security-audit/ ), which may mean much fewer are reported over the next few years, as they were all found last year.