What fraction of software bugs are security vulnerabilities? Obviously, software bugs can be security vulnerabilities -- but also obviously, many software bugs have little or no security impact. Is there any data (or rules of thumb) on roughly what fraction of software bugs are also security vulnerabilities? Or a rough range of values?
Well, obviously any estimate is going to fairly hand-wavy, since if we knew the existence of all bugs and could enumerate them, then the bugs probably wouldn't have shipped. So these bug counts are based on bugs found after the fact. Scrutinized software will naturally have proportionally more of its bugs discovered than rarely used software, so our measurement technique is biased.
But here's a post that references Code Complete saying 10-15 bugs per KLOC:
And here's a post right here on SO that estimates security bugs at at a max of .05 security bugs per KLOC:
So one rough estimate to your answer is .05/15 = .003333. It's a fairly small proportion.
So how many security flaws are left undiscovered? Flaws in security, unlike other software flaws go noticed until an attacker has shed light upon it. Tomorrow might yield a entirely new attack pattern, and in this new light we find that all of the software that we use is horribly insecure.
... and this has already happened. Aleph one and buffer overflows, finding out that some format string bugs can be exploited, dangling pointers, H.D Moore and DLL hijacking, oah and don't forget about [fill in your favorite attack here].