May I point you to Wikipedia pages on cognitive biases, like Confirmation and Selection? The CVE database lists only entries related to situations gone wrong.

May I point you to Wikipedia pages on cognitive biases, like Confirmation and Selection? The CVE database lists only entries related to situations gone wrong. It doesn't list any information about working software that has no issues. Also nothing will appear in the CVE database in relation to a language that nobody uses. The database also has some garbage entries. Overall the database is actually paltry in size in relation to the vast amounts of stuff out there written in C. Also, correct C programs can have security issues, because some security issues depend on actual behaviors being observable which correspond to behavior that is not observable according to language standard. ISO C is mum about memory being observed, or side channel information being monitored, or timing of operations.