A new technical paper forecasting vulnerabilities should help you answer this question.