To be actually fair, you should probably only look at CVEs concerning new-ish code.