There is an interesting post on Bugtraq from Steve Christey, CVE Editor titled
Open Letter on the Interpretation of "Vulnerability Statistics"
See:

http://www.securityfocus.com/archive.../30/0/threaded