It is worth reading the SourceFire report as it gives an interesting look at the disclosed vulnerabilities over the years.
Forum trolls will delight in being able to quote it for/against any fanbois of OS as well. It has some correct, possibly controversial, ways of reporting, for example counting the webkit browser engine as "Apple" so the CVE count is way higher than you might have expected. Similarity it treats Linux as one product, but the different versions of Windows as separate (mostly, this is discussed).
However, what the report lacks is the exploit count relating to these. For example, it has the iPhone as much worse than Android by CVE count (210 versus 24), but we all know that Trojans and general shit-ware, etc, for Android are much, MUCH bigger problem in practice.
Oh, and check your buffers please? That is the No.1 vulnerability of the quarter-century!