I've been asked to compile a list of the number of published web vulnerabilities or exploits grouped by platform.
With the understanding and caveat that numbers are just statistics, shouldn't be used to predict the future, are totally unfair, worse than lies and damn lies, and probably will kill your cat, etc., etc.: Do these numbers exist anywhere? How can such a list be compiled?
I figured the CVE database was a good place to start; you can download their entire database in CSV format and then just
grepit. Which seemed reasonable enough, except it appears that there isn't enough data in each row.
For example, of the 59 CVEs this year that mention "Wordpress", there are 14 that don't contain the letters "php". So clearly grepping for "php" won't net the right result. Presumably neither will any of the others.
The data don't have to be perfect, they just have to be reasonably substantiated (i.e. not pulled out of one's derriere), and most importantly the measurement should be neutral (that is, shouldn't obviously favor or penalize any given platform), except to the extent that any one platform is naturally more popular than another.
Recent numbers (last year, this year, whatever) would be best, but whatever exists is even better.