# Unveiling the Landscape of Operating System Vulnerabilities
## 5 Findings and Discussion
### Year-Wise Vulnerability Results and Pattern Analysis  
After sampling the top highly vulnerable OS categories, we studied the evolution of vulnerabilities during the period of 1999-2022. Figure 6 shows the stacked bar chart demonstrating the year-wise pattern for our top 10 vulnerable OS categories with the number of reported vulnerabilities. The following are some important and interesting observations from in Figure 6:  
* For the listed top 10 OS categories, the growth in vulnerabilities over the years 1999-2022 indicates an Exponential Distribution pattern. From another perspective, we can observe that the highest number of vulnerabilities was reported in 2020, after which the increasing trend was broken and the graph tends to show a downward slope until 2022. This shift can be interpreted as the commencement of the second half of a Gaussian Distribution, with the data from 2020 serving as the mean value. * In 2017, the number of vulnerability reports impacting Fedora was notably small, with only 42 reports. However, in the subsequent years until 2022, there was a significant increase in the number of vulnerability reports affecting Fedora. This indicates a considerable growth trend in the vulnerabilities associated with the Fedora OS and its versions during that period. Figure 4: Top 10 highly vulnerable OS versions under corresponding OS categories based on all-time vulnerability reports of OS versions using the OS_VER dataset with 465,084 data points. * Debian Linux shows an increasing trend until 2018 and a decreasing trend was seen in recent years, starting in 2020. Android exhibits a slow increment in vulnerability reports across each year, with a total of 1266 reported vulnerabilities in 2022. * Ubuntu Linux had the highest number of vulnerabilities in 2018. However, after 2018, it exhibited remarkable resilience and stability, as reflected in the significantly reduced vulnerability reports. Specifically, in 2022, Ubuntu Linux encountered a mere nine vulnerability reports. Similarly, openSUSE also experienced an upward trend in vulnerability reports until 2020. However, in recent years, there has been a substantial decrease in the number of vulnerability reports. Specifically, in 2021, there were only six reported vulnerabilities for openSUSE, and in 2022, the number was further reduced to just two entries. This remarkable improvement underscores the efforts made by Ubuntu Linux and openSUSE to bolster the security and reliability of the Linux distribution. * The Apple OSs, including Mac OS, iPhone OS, and tvOS, consistently demonstrate a relatively low number of vulnerability reports compared to other OS categories. However, the consistency in vulnerability reports each year does not necessarily imply a decline in vulnerabilities. Instead, it suggests that the vulnerability landscape for these Apple OSs remains relatively stable, with a consistent number of vulnerabilities being identified and reported annually. It highlights the need for ongoing security measures and regular updates to address and mitigate these vulnerabilities effectively, despite the consistent number of reports. Figure 5: Top 10 vendors with the highest number of vulnerable OSs based on all-time vulnerability reports of OS categories using the OS_CAT dataset within the timeframe of 1999–2022. Continuing the analysis, Table 4 presents the vulnerabilities of the top 10 unique OS versions during the recent period from 2021 to 2022. Notably, all these OS versions remain actively supported by their respective vendors. The analysis reveals that in recent years, Windows 10 stands out as the most highly vulnerable OS, with a substantial number of 8659 vulnerability reports. This highlights the challenges faced in maintaining the security of Windows 10 and the need for robust security measures to mitigate potential risks. Following Windows 10, the next vulnerable OS is another product from the Windows family, namely Windows 11, with 1293 vulnerability reports in recent years.