Oracle Linux tells a slightly better story. While Big Red did release 285 patches, only two of those carry CVSS scores over 9. Both involve vulnerabilities in the gstreamer1-plugins-base library.