Secunia does seem selectively clueless (I think of it more as fear-mongering, what with the Twitter posturing and stealth edits of their reports), but AFAIK the

Secunia does seem selectively clueless (I think of it more as fear-mongering, what with the Twitter posturing and stealth edits of their reports), but AFAIK their vulnerability index exists to be linked from their "software inspector" products which scan binary Windows releases, which do tend to include bundled libraries. However, their blog post makes no mention of that, and they don't seem to question the link between vulnerability PR and actual, verifiable vulnerabilities.