While the track record of security in the industry is pretty laughable, I do like to delude myself that things are improving. How many RCEs are discovered per

While the track record of security in the industry is pretty laughable, I do like to delude myself that things are improving. How many RCEs are discovered per year in baseline Debian/Ubuntu? Seems far more likely that security holes are in the library/application code layered on-top of an image.