There can be no such list, because vulnerabilities don't exist on ports - they exist in services. While services may normally run on a certain port, there's nothing to prevent someone from e.g.: running a web server (normally port 80) on port 23 (normally used for Telnet), hosting their IRC service (normally port 194) on port 161 (normally SNMP), or setting their Windows Terminal Services (a.k.a. RDP - usually on 3389) host to port 56729 (an uncommon port, not generally used for servers).
Even trying to build a count of vulnerabilities per service is inaccurate, because services are provided by applications and multiple applications are capable of providing a given service. For example, an Apache server will have different vulnerabilities from an IIS server even though they're both providing the same service - HTTP.
The hole just goes deeper and deeper, depending on how the applications are built or what plug-ins or other applications are running on top of them.
For a real vulnerability assessment, you need to look at your system and check the OS and applications against a database of known vulnerabilities (e.g.: OSVDB or NIST NVD). If you're looking to figure out which services you need to disable or block due to high vulnerability, don't. Simply disable/block all which are not essential to your operations, and keep those which are patched and up to date.