Yeah, it’s funny when people shit on Linux just because people care enough to disclose vulnerabilities. Trust me that any proprietary system has just as many; they just get silently patched in this month’s security update. Computers are finicky things; the amount of known CVEs is simply a measure of how many people pentest the software and how big the project is, rather than any statement about its security.