This was surprising to me…

2008_most_vuln_disclosures