At first read that sounds very reasonable! But then you realize that not all vulnerabilities got a security advisory...