% VULNERABLE %

Here's the Top 10 List:

The Veracode research report used a unique metric, Flaw Density per MB, which means the number of security bugs in each MB of source code.

Here's the list of unlucky winners:

• Classic ASP – 1,686 flaws/MB (1,112 critical)
• ColdFusion – 262 flaws/MB (227 critical)
• PHP – 184 flaws/MB (47 critical)
• Java – 51 flaws/MB (5.2 critical)
• .NET - 32 flaws/MB (9.7 critical)
• C++ – 26 flaws/MB (8.8 critical)
• iOS – 23 flaws/MB (0.9 critical)
• Android – 11 flaws/MB (0.4 critical)
• JavaScript - 8 flaws/MB (0.09 critical)