These figures could be correct if both sides would disclose all hidden fixes. If they are not, one is actually fixing the figures instead of vulnerabilities, and thus count is so wrong.