On a CVE basis for the number of distinct vulnerabilities, Android is ranked as having the most vulnerability of any piece of software for 2016 followed by Debian and Ubuntu Linux while coming in behind them is the Adobe Flash Player…

Source: Phoronix – Android, Debian & Ubuntu Top List Of CVE Vulnerabilities In 2016