Answers are grounded in this paper and cite their sources.
Where do most vulnerabilities occur in software? Our Vulture tool automatically mines existing vulnerability databases and version archives to map past vulnerabilities to components. The resulting ranking of the most vulnerable components is a perfect base for further investigations on what makes components vulnerable.
No takes yet. Share an insight, caveat, or question.
Neuhaus et al. (2007) studied this question.