[stavros]

A CVE list says nothing. I made my own language which has no CVEs, that obviously doesn't mean it's secure. The relevant metric is "CVEs per unit of functionality".

[sedatk]

Also, popularity directly affects the number of CVEs.