4 ms·US-CERT lists the 10 most-exploited security bugs and, yeah, it's mostly Microso2 points by based2 6y ago