Qubes OS has a public CVE list now and it is shorter than you think
Fifteen years of a compartmentalised desktop OS, zero remote code execution bugs. The paper tracking every public Qubes vulnerability is out.
Read the note 1 min read
From the notebook
qubes-os.
1 note on this topic.