The average application contains 26.7 custom code vulnerabilities, vs. just two CVEs in library code.