> Here are three more data points.
>
> * Emacs - 41 CVEs since 2000 [1]
> * Vi - 61 CVEs since 1999 [2]
> * Vim - 656 CVEs since 2001 [3]
>
> I'm not sure how many CVEs overlap for Vim due to Vi.
I don't know what the number of CVEs tells us about a project, but the
above additionally suffers from the fact that it's just searching for
a keyword, so for `vi` most(all?) matches are unrelated to the
famous editor.
Stefan